title: Can something "bad" happen via img src?
body: <p>I know, I know, title is quite bad, but I'll try to explain what I mean here. So, I ask my members to show their photos. They upload it somewhere, then paste their photos' URL into input and I save it to my database (MYSQL). Then, the photo is being seen on their profiles. I get the URL from database and do something like that: <code>&lt;img src="&lt;?=$photo;?&gt;" height="123px" width="123px"&gt;"&gt;</code> where <code>$photo</code> is URL taken from MYSQL. Is it totally safe? Can somebody upload for example .php file and harm my website? Do I need to check if URL's ending is .gif, .png, .jpg?<br>
  Thank you.<p></p>
  
  <p><strong>Edit:</strong> Yeah, of course I would protect my website from SQL injections and XSS attacks. But is there any way to harm my website in other way?</p>