I know, I know, title is quite bad, but I'll try to explain what I mean here. So, I ask my members to show their photos. They upload it somewhere, then paste their photos' URL into input and I save it to my database (MYSQL). Then, the photo is being seen on their profiles. I get the URL from database and do something like that: `<img src="<?=$photo;?>" height="123px" width="123px">">` where `$photo` is URL taken from MYSQL. Is it totally safe? Can somebody upload for example .php file and harm my website? Do I need to check if URL's ending is .gif, .png, .jpg?  

Thank you.
**Edit:** Yeah, of course I would protect my website from SQL injections and XSS attacks. But is there any way to harm my website in other way?