显示来自其他站点和安全性的内容

Question

I'd need to load an user given URL and display a div with my content after the content of the user given website.

Implementing this would be trivial:

$c = file_get_contents($url); 
echo $c . $myDivCode;

However, wouldn't this open my server to all kinds of security issues, such as XSS?

If so, what would be the best way to handle this taking into account I would like to be able to display the content of the user given URL as well as possible (i.e. run all the safe scripts).

Answer 1

The best way probably would be to display site in an iframe like that:

echo "<iframe src=\"$url\"></iframe>";

This way user loads the page directly from the url, without your server proxying it. However, since you're displaying information from another site, your site will always be vulnerable to XSS unless you remove scripts and HTML completely.