Detect (and block) a GET request hidden in an image
<p>It came to my attention a while ago that some people were posting "images" on my forums, which, when viewed by a logged-in user, forced them to perform actions on the site they may not want to. The actions in question are normally performed by a simple GET request to the relevant page.</p>

<p>This has been patched by requiring all non-trivial changes to be POST requests, but I was left wondering about this:</p>

<p>Is it possible to detect when a browser is expecting an image, and block a PHP script from being run if so?</p>

<p>My initial attempt was:</p>

<pre><code>&lt;?php
    if( isset($_SERVER['HTTP_ACCEPT']) &amp;&amp; $_SERVER['HTTP_ACCEPT'] != ""
     &amp;&amp; stripos($_SERVER['HTTP_ACCEPT'],"image/")) die("Insert error message here");
?&gt;
</code></pre>

<p>However, while it worked perfectly in IE and Firefox, Google Chrome (for some reason) includes "image/png" as part of its Accept header, causing users to be unable to load any pages that were "protected".</p>

<p>So clearly this idea works in theory, but in practice it's unreliable. Is there a reliable method to this?</p>
