Moreover lets not forget XSS as well. Need to be careful. Think if you're going to post an image URL, server will need to do some validation that its an actual

Moreover lets not forget XSS as well. Need to be careful. Think if you're going to post an image URL, server will need to do some validation that its an actual image and then spit it inline