Oh god, thanks. I was confused about this new-fangled technique of using "HTTP headers" to pass pricing information...
That makes sense. It was worth the negative karma to solve the mystery. :)
With PHP you can create the headers at the top of the page, with python you can create a 'script' that sends custom headers to a server, thus you could tell the server that its a image via the headers but it could be something different ie a script... Any good developer will look out for this stuff though.
So how does the website get my browser to run a python script?
According to the article, this was supposed to work for normal users, not people hacking the server.
All I meant to say was that its easy to send custom headers to a server.
You can send custom HTTP headers from the browser with XMLHTTPRequest, commonly referred to as AJAX. Not totally sure if this is what the poster is referring to, but its possible.
ok, I didn't think a payment processor would be using a cross domain xmlhttprequest, but I don't know a lot about it.