Javascript refresh triggered or intentional? -

if user clicks refresh or f5 or refreshes tab left click/reload intentional action!

can hacker inject script maybe in image src (but not specific;) or anywhere else on page, forces reload/redirect?

if so, there in onbeforeunload event tell me triggered code?

wow

window.onunload=function(e){console.dir(e);} location.reload(); event navigated https://www.google.com/webhp?hl=en 

proof kaii correct! wonder why browser venders don't make object of event - @ least check if refresh user intention???

can hacker inject script maybe in image src (but not specific;) or anywhere else on page, forces reload/redirect?

yes, i.e.:

<script>window.location = window.location;</script> 

if so, there in onbeforeunload event tell me triggered code?

no. event object observable during onbeforeunload() not contain trace of information cause of unloading.