An image can be displayed through a .php source if the source has a proper header (as per the answer to this question).

If a website allows something.php as the image source, and displays the image (as described above), is it possible to include some kind of javascript in something.php that will also run when the hosting site retrieves the image? (This seems like it could open things up to a possible XSS)

  • I don't see how PHP is relevant. What's the difference between serving a PHP script that returns JavaScript, and a file that is JavaScript? Commented Jan 31, 2018 at 1:07
  • @AndrolGenhald I'd say this is a duplicate, yeah. Commented Jan 31, 2018 at 2:25
  • @multithr3at3d Because the website wouldn't allow something.js Commented Jan 31, 2018 at 2:25
  • I don't think the file extension really matters... Commented Jan 31, 2018 at 2:38

1 Answer 1


To answer the question, no it is not possible.

Let's say the image is sourced as below for example.

<img src="http://somesite.com/something.php">

If something.php doesn't render as an image, the browser will display an [X] or not display the invalid/corrupt image.

If you throw in some javascript inside something.php will have no effect at all.

Not the answer you're looking for? Browse other questions tagged .