Images generated via PHP are broken

[shaine]

The JS injection code seems to run when PHP generates an image. For reference, the following headers are set when generating the image:

• Pragma: public
• Expires: 0
• Cache-Control: must-revalidate, post-check=0, pre-check=0
• Content-Transfer-Encoding: binary
• Content-type: image/png