we need avatars

Yeah

MM (O_o)

Hi,

good idea I already thought of but I wan't to let people load up their own ones. That's no problem at all but I thought about something coming along with this and that still needs some thinking.

bye, Erik

avatars are always a little bit "hot". many exploits exist that make use of bad filtering in the avatar option.

not really
only avatar exploit is the infamous *.swf avatar exploit that lets you insert javascript to implement cookie stealers
there are ways to make dynamic avatars but its impossible for them to munch on cookies or run javascript unless there *.swf

Then only allow bmps... or other predetermined file fromats. I don't think you can do too much with a bmp.

you cant do much with any picture format
you can run code in a pic but the code gets executed server side on the server that hosts the pic
the pic cant grab cookies because its only possible to grab cookies from yur own server
*sigh*

YES! I can grab the IP address of anyone seeing my jpg image!

yah but who cares about there IP and its not like you know whos is whos. and what would you do with an ip? other than script kiddie stuff that most likely wont work on the person? but for all you know it can be yur ip

^

MM (O_o)