What happens underneath the hood when the url is specified in the src attribute. In other words what happens when I do this:

<img src="//test/exploit.js" />

Does this "include" the file? and I mean by "include", does it interpret the code in the file?

1 Answer 1


The src attribute of the <img> tag takes a URL of an image. I don't think it is the case that when you put a URL of a JS file as a value for any attribute named src, the code in the file gets interpreted.

If you want your JavaScript code to get interpreted, it has to be either enclosed by <script> tags. For example:


<!doctype html>

In case the code was in a separate file, the URL of that file should be set as the value to the src attribute of a <script> tag which is different from the src attribute of an img tag. For example:




<!doctype html>
        <script src="code.js"></script>

Update: answering your questions in the comments section

Now, a Cross-Site Request Forgery (aka CSRF) attack is a different thing. As I mentioned earlier, the value of the src attribute of an <img> tag should be a URL of an image. The browser typically sends an HTTP request to request that image using the value of the src attribute which it assumes that it is a URL of an image.

Suppose I'm dealing with a bank whose website is somebank.com and that I can perform all sorts of different transactions via this website, but I have to be logged in of course.

Suppose the bank's website authenticates me by sending a cookie to my computer that the browser will automatically send back to the bank's website when I visit it again in the future.

Now, suppose I still have the cookie on my computer and that it did not expire. If I visit a bad website, let's call that badsite.com, the attacker behind this site could have an element like this in the page

<img src="https://sombank.com/transferfunds.php?amnt=10000&acct=123456">

My browser, behind the scenes, will make an HTTP request with that URL and as you could probably see, I'll end up having $10000 transferred from my account to the attacker's account (which is 123456 in this case).

Now, that's definitely different from what you asked because JavaScript code gets interpreted by a JavaScript engine that is typically built-in to your browser. Here's the thing: the browser did not run any JavaScript code in the example above and it wouldn't run the code in a JS file if the URL was a value to the src attribute of an img tag.

  • But one of the forms of CSRF attack is this: <img src=https://sombank.com/transferfunds.php?amnt=10000&acct=123456 /> I asked this question because of that. Here, a new HTTP request is sent to this file but what happens then, should it interpret the code in the file? I made a file named foo.html and another one bar.html and in the first I wrote this: <img src=bar.html" /> But it doesn't interpret the javascript code in bar.html, so what happens in the CSRF attack then? Feb 11, 2015 at 17:28
  • @FaroukSabry please see the Update section in my answer!
    – kzidane
    Feb 11, 2015 at 18:10
  • @Kaeem I'm confused now so, please bare with me. In the example of somebank.com the HTTP request was sent and the code in transferfunds.php was "interpreted", right? So why the Javascript code in bar.html in the example in my first comment wasn't interpreted? Sorry, but I didn't get the last two lines in your answer. Feb 11, 2015 at 18:47
  • @FaroukSabry the code in transferfunds.php is PHP code. PHP code is interpreted on the server. JavaScript code is interpreted on the client's side (by the browser). JavaScript code is interpreted when it is used in the context of a <script> tag, as the beginning of the answer says, and this happens exactly when the HTML page is rendered in the browser.
    – kzidane
    Feb 11, 2015 at 21:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .