Basically, the interpreter in the browser ignores the image data and runs the payload string. Researchers at Devcon discovered this trick used in the wild, disguised as a normal BMP file.

While JavaScript has many applications, working with string values is one of the most popular. Strings are objects within the JavaScript language. They are not stored as character arrays, so built ...

News JavaScript Made Easy: How to add multiple image rollovers to your webpage By Dori Smith FEB 28, 2001 4:00 pm PST ...