I'm building a website for an association. Its aim is to, out of other thing, provide an easy mail manager to communicate with the member, stored in a database. This database is always up to date as it used to manage the members status, contributions, etc. That's why I want to use a integrated "custom" webmail instead of, for instance, RoundCube.
So the user can send mail from this website using the association mail address and SwiftMailer, and would like to be able to check the corresponding inbox from this very website.
I found out that there is a php IMAP extension, which seems to fill my needs, I can fetch eMails from the IMAP server. Though, I am affraid to create a security breach in the user's computer by making possible to display, for instance, spams, or malware contained in attachements. As I couldn't find anything on the internet, and I suppose displaying only text eMail would work (but it's not as user friendly) what would be the rules to build a secure eMail reader from an IMAP server that tends to be spammed?