What HTML could be harmful to a proxy site?

Displaying another sites html safely

[grahamstewart]

I have an idea for new site, but one of the things putting me off is the security aspect.

On the site you would enter the address of another site in a text box. The contents of that site would be fetched by php, parsed, manipulated, and then displayed in a frame.

So effectively I will be displaying another sites html from my address and I must assume that the other site could be hostile.

What tags would I need to strip out to make sure I was left with safe html?

(So far I reckon on

object

,

applet

and

script

- any others I should be wary of?)

[tombola]

I must assume that the other site could be hostile.

What would you expect, when you are stealing content of someone else?...

What would you do, if another "webmaster" puts your content into a frame on his site?...

[grahamstewart]

Nope, it's not for stealing content.

The service would fetch other websites and manipulate them.

As an example think of a translation site that allowed you to view the original site in its intended layout, but translated into an appropriate language.

[tombola]

Ok, do you "use" this content with permission of the webmaster in question?

[grahamstewart]

Nope, but I don't envisage webmasters objecting to the usage and I would be prepared to block access to their sites if they wished me to do so.

Do you object to BabelFish translating your site for potential customers?

[brotherhood of LAN]

graham, I'm doing the same thing for a KW density analyzer, not quite the right forum but using something like PHP's htmlentities() function should prevent anything "happenining" if you place the foreign HTML inside something like this function.

[grahamstewart]

Ahh.. but I'd like to actually display their website as it should be in an frame, but altered by my process.

htmlentities would just allow me to display their code.

[brotherhood of LAN]

I'm no HTML buff but "object, applet and script" sounds like best plan, only dangerous HTML i can think of is <blink> :)

Also might want to consider frames in your coding....2c