title: Preventing iframe injection via url?
body: <p>I'm trying to prevent attacks where a url can be distributed that inserts an iframe (containing a fake login screen) into a PHP site using javascript in the url. Is there some way with PHP to clean out URLs of a page before it is loaded?</p>
  
  <p>The url looks like something like: <code>login.php?login_nav_map=%2Fv3%2Farchives%2Findex.php%22/%3E%3Cimg%20src=%22no.jpg%22%20onerror=%22document.write%28String.fromCharCode%2860,99,101,110,116,101,114,62,10,60,105,109,103,32,115,114,99,61,34,104,116,116,112,58,47,47,119,119,119,46,119,111,114,108,100,116,118,112,99,46,99,111,109,47,98,108,111,45,99,111,110,116,101,110,116,47,117,112,108,111,97,100,115,47,50,48,49,49,47,48,56,47,97,98,99,45,111,110,108,105,110,101,45,116,118,46,106,112,103,34,47,62,60,98,114,47,62,10,60,104,49,62,65,100,</code></p>
  
  <p>and the char codes insert an iframe into my page which I do not want there.</p>