If you let images with code injection be saved on your server, it is possible, that it's a highwayto your php files and whole database, so it is important to make sure, that if user uploads avatar, it is really an avatar, not some hacky stuff with code injected into the image.