Ok, here is a scenario for you here.
You have a database. You have a table in it that you will store small 30x30 pixel PNG images. They are base64 encoded. They will be echoed out as an avatar for the profile.
Can this be done with a base64 encoded image? Is an attacker capable of crafting something that can introduce this sort of risk? If so, what can I do to mitigate the threat?