I found a PHP script in a GIF file

Question

Is it possible for a PHP script to be inside a GIF file? I found one when I opened a .gif file in notepad++.

Answer 1

I've seen this done (although usually with the .jpg extension) for serving images from a database...

Assuming your using apache, you just have to tell apache to process that specific file as if it were php.

Answer 2

Finding php in a gif file could indicate someone is trying to attack you're server. This is an interesting read about secure file upload and php.

Answer 3

The file extension doesn't need to be the same as the file contents, so yes it's possible to save a text file or PHP file with the .gif extension. It won't (usually?) show as an image in a browser or other application, and nor is it likely to run as a PHP file on a web server unless the server has specifically been configured this way.

The benefits of doing this aren't clear to me unless it's used as a sneaky way to try and execute PHP code via an image upload form, where the server has been configured to execute .gif files as scripts (i.e. any extension goes).

Answer 4

You could always use mod rewrite to change the file extension if thats what your getting at?

Answer 5

Actually, there are a couple of things that are possible (and commonly used for things like hit counters.)

Consider this:

<img src="myPicture.php" />

myPicture.php might look like this:

<?php
// Use PHP's GD image libraries.

// Create the image
$my_img = imagecreate( 200, 80 );

// set image attributes

// Set the header to indicate we're sending image data, rather than ASCII
header( "Content-type: image/png" );

// Output the image
imagepng( $my_img );

// cleanup
?>

So, the output of your PHP script is not ASCII text (or HTML), it is the binary of a .png file. Thus the header() is set to indicate this, and the imagepng() functions shown actually output the raw PNG image data. (example lifted from here).

Another option, which others have mentioned involves a "normal" image tag:

<img src="myPicture.png" />

Notice this ends in ".png". In this case, the web server would have to be configured so that it parsed not only .php files as executable PHP code, but also .png files. Your code would look the same, but it would be wrapped in "myPicture.png" rather than ".php".