> I don't believe malicious code can be executed with echo and header.

The header of the PNG file, not a HTTP header.

--
Richard Heyes

+----------------------------------------+
| Access SSH with a Windows mapped drive |
| http://www.phpguru.org/sftpdrive |
+----------------------------------------+