security - Is this jquery code secure? -
is following code secure? $iframe = $('<iframe id="iframe" src="' + $(this).attr('rel') + '" name="iframe">'); $area = $("#ajax-area"); $area.empty().append($iframe); where: $(this) link clicked. attr('rel') holds src iframe , rel created php (no user input here). and $iframe holds form upload. my concern is, since in case iframe's src variable fear malicious user somehow manages edit 'rel' attribute , open iframe or wants. possible? edit thanks valuable answers. php uses following populate rel: app::basepath . '/some/path/to/my/folder'; where basepath constant developer chooses. i'll redesign jquery in more proper way guys suggested. theoretically, if rel attribute based on server constant, there should no additional security issues other ones can't control, such mitm. however, should on safe side these things; , jquery provides safety a...