PHP Security - GET Variables, URL safe?

I am creating a very basic iPhone simulator and what I want to do is just have it in one location, and then any site that we have and want to put it on, we would just call it using: http://www.example.com/iphone-test.php?url=http://www.example.com/mobile/

Is there anything I need to look out for that could be un-safe? There is no database involved or anything, but just in case someone wanted to mess around and put some stuff in the URL, what are some things I can do to help make this a little more safe?

Here is my code:

<?php
    if(isset($_GET['url'])) {
        $url = $_GET['url'];
        ?>

        <!doctype html>
        <html lang="en">
            <head>
                <meta charset="utf-8">
                <title>iPhone Test</title>
                <style type="text/css">
                #iphone { 
                    background:url(iPhone.png) no-repeat; 
                    width:368px; height:706px; 
                    position:relative; 
                    overflow:hidden;  
                }
                #iphone iframe {
                    position:absolute; 
                    left:30px; 
                    top:143px; 
                    border:0;overflow:hidden; 
                }
                </style>
            </head>
            <body>
                <div id="iphone">
                <iframe src="<?=$url;?>" width="307" height="443"><p>Your Browser does not support iFrames.</p></iframe>
                </div>
            </body>
        </html>
        <?php
    }
?>

Edit: Thanks for all of your help. I did some research and here is what I have so far:

<?php
include_once 'filter.php';
$filter = new InputFilter();   

if(isset($_GET['url'])) {
if (filter_var($_GET['url'], FILTER_VALIDATE_URL)) {
    $url = $filter->process($_GET['url']);
?>

Source: http://oozman.com/php-tutorials/avoid-cross-site-scripting-attacks-in-php/

Class: http://www.phpclasses.org/browse/file/8941.html

What do you think?

Solution

If this page is accessible for anyone to access then you are opening yourself up to XSS and Phishing redirects. For example, try adding this to your URL params:

?url="></iframe><script>alert(123)</script>

In Firefox 6.02 that fires off the alert. Which means that any JS could be fired and used to redirect users who think they are visiting your site. Or it could be used to steal cookies that are not marked HTTPOnly.

This can be mitigated by encoding for HTML attributes. Which is described here from OWASP:

Except for alphanumeric characters, escape all characters with ASCII values less than 256 with the &#xHH; format (or a named entity if available) to prevent switching out of the attribute. The reason this rule is so broad is that developers frequently leave attributes unquoted. Properly quoted attributes can only be escaped with the corresponding quote. Unquoted attributes can be broken out of with many characters, including [space] % * + , - / ; < = > ^ and |.

Reference: https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.232_-_Attribute_Escape_Before_Inserting_Untrusted_Data_into_HTML_Common_Attributes

Now, for your other issue that the above will nto address. If you allow just any arbitrary URL to be entered, then there is nothing stopping someone from doing something like this:

?url=http://myevilsite.com/redirect.php

And have that page redirect the user:

window.top.location.href = "http://www.site.com";

The only thing you can do about that is to use a white list of acceptable URLs.