Ok, here is a scenario for you here.

You have a database. You have a table in it that you will store small 30x30 pixel PNG images. They are base64 encoded. They will be echoed out as an avatar for the profile.

I have seen tricks in the past with XSS that use image tags to retrieve javascript code.

 <IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">

Can this be done with a base64 encoded image? Is an attacker capable of crafting something that can introduce this sort of risk? If so, what can I do to mitigate the threat?

  • 1
    XSS isn't about the image, but about the javascript code (in your example). If an attacker can influence the code, he specifies the source of the image to be an image that he controls.
    – schroeder
    Mar 17, 2015 at 2:37
  • I know this. Can an attacker build an image that introduces the code (some sort of Polyglot)?
    – Meh
    Mar 17, 2015 at 2:55
  • You typically use an image handler for this, and refer to the image by your own id. So something like src="imgs.mysite.com?id=123" where 123 is the id of the image in your database. Is this the scenario you mean to ask? Mar 17, 2015 at 3:33
  • Or do you mean embedding base64 into the src? danielmclaren.com/2008/03/… Mar 17, 2015 at 3:40
  • @Meh: You mean like <script src="//example.com/imagegenerator?with=datainterpretedascode">?
    – Bergi
    Mar 17, 2015 at 11:52

1 Answer 1


Assuming you're handling the image data in a sensible manner, no. The data never gets put in a place where it could be seen as code.

Even if you're not handling the image data in a sensible manner, probably not. The base64 "alphabet" is missing some of the characters essential to producing useful Javascript -- there's only so much you can do with +, /, =, and the alphanumerics. Without parenthesis, brackets, semicolons, spaces, or quotation marks, you can't construct an SQL injection or a Javascript function call.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .