Using php as an image path in an email, any concerns?

Question

A previous employee created emails that use php to generate an animated gif. I grabs the user's location and create countdown based on local time. Apparently it worked fine when he did it last year but since I never see anyone doing this, there may be a reason I'm not aware of:

<img height="74" src="http://companysite.com/images/generated/countdown-seconds.php" border="0" style="color:#ffffff;overflow:hidden;background-color:#5A5552;font-size:64px;font-family:Helvetica, Arial,sans-serif;" alt="&nbsp;: 59">

Is there a reason you wouldn't want to do this or any concerns with doing this in email?

[just these comments](http://stackoverflow.com/questions/5448381/tracking-email-with-php-and-image) — WEBjuju, Dec 02 '16 at 22:55

score 0 · Answer 1 · answered Dec 02 '16 at 22:58

0

Maybe the biggest problem that you might have is that user won't know why they can't view the image when they download the image (because it will be downloaded as .php instead of a normal image extension). Other than that, it'll be perfectly fine.

answered Dec 02 '16 at 22:58

Imam Assidiqqi

516
4
20

if php is serving up an image *properly*, when the user saves it it will have the proper extension, not `.php` – chiliNUT Dec 02 '16 at 23:58

score 0 · Answer 2 · answered Dec 02 '16 at 23:44

0

It may display old data.

Some webmail hosts -- most notably Gmail -- will aggressively cache images referenced in messages. This may result in some users seeing an old image.

answered Dec 02 '16 at 23:44

score 0 · Answer 3 · answered Dec 04 '16 at 06:10

It can create security problems for the user. If the php script is compromised, then it can be used to display any type of image or even insert malicious JavaScript code. For example it can be used for phishing attacks.

Many email clients have strict security policies regarding images and block images by default

Using php as an image path in an email, any concerns?

3 Answers3