But you still need to be careful with the output, lets say someone manages to get an 'evil' url into wikipedia, and you retrieve the following url:

```
http://foo.com" onmouseover="alert('boo!')
```

when you hover the image, code gets executed in the context of your site (say discourse). Of course this example is innoceous, but you could use this technique to post in your name, or if you're admin ban users, etc.

Again, I think it's quite improbable in this case, but it would be good to pay attention to this. I noticed that this wasn't done before (in the old oneboxes), and I think it would be wise to do good security from the start, since you're recreating the oneboxes.