HTML Validation

Bad value “” for attribute “src” on element “iframe”: Must be non-empty.

About This HTML Issue

An <iframe> element allows to embed an HTML document inside another HTML document, and its src attribute is indicated the source URL of the embedded web page. The src attribute is a required attribute, so it cannot be blank.

Example:

<iframe src="https://example.com/map.html"></iframe>

Learn more:

→ HTML Living Standard: src attribute on iframe

Last reviewed: October 27, 2022

Was this guide helpful?

Find issues like this automatically

Rocket Validator scans thousands of pages in seconds, detecting HTML issues across your entire site.

Start Free Trial See Pricing

Related W3C Validator Issues

Bad value X for attribute “name” on element “iframe”: Browsing context name started with the underscore.

The value of the name attribute on an <iframe> should not start with an underscore (_).

Browsing context names that begin with an underscore are reserved keywords in HTML, like _blank, _self, _parent, and _top. Using these reserved names or any custom name starting with an underscore for the name attribute of an <iframe> can lead to unexpected behavior and is considered invalid HTML.

Here’s how to fix the issue:

Problematic Code

<iframe src="https://example.com" name="_example"></iframe>

Solution

To resolve this issue, you should use a valid value for the name attribute that does not start with an underscore.

Corrected Code

<iframe src="https://example.com" name="example"></iframe>

Steps:

Identify the iframe element with the invalid name attribute value that starts with an underscore.
Replace the name value with a valid identifier that does not start with _. Use letters, numbers, hyphens (-), and underscores (_) (but not at the beginning).

Bad value for attribute “src” on element “iframe”: Illegal character in query: “[” is not allowed.

Illegal character “[” in the iframe src URL requires percent-encoding or removal.

The iframe element’s src must be a valid URL. According to URL syntax, characters like [ and ] are not allowed in the query unless percent-encoded. If your src contains array-like parameters (e.g., filters[category]=news), encode reserved characters: [ becomes %5B and ] becomes %5D. Avoid spaces and encode other reserved characters as needed. Alternatively, adjust the server to accept dot or bracketless notation (e.g., filters.category=news or filters_category=news) so the URL stays valid without encoding.

HTML Examples

Example causing the validator error

<!DOCTYPE html>
<html lang="en">
<head>
  <title>Iframe URL Error</title>
</head>
<body>
<!-- [ and ] are illegal in URLs unless encoded -->

  <iframe src="https://example.com/embed?filters[category]=news&filters[tags]=web"></iframe>
</body>
</html>

Fixed example with percent-encoding

<!DOCTYPE html>
<html lang="en">
<head>
  <title>Iframe URL Fixed</title>
</head>
<body>
<!-- Encode [ as %5B and ] as %5D -->

  <iframe src="https://example.com/embed?filters%5Bcategory%5D=news&filters%5Btags%5D=web"></iframe>
</body>
</html>

Bad value “” for attribute “(width|height)” on element “iframe”: The empty string is not a valid non-negative integer.

Bad value “X” for attribute “sandbox” on element “iframe”: Setting both “allow-scripts” and “allow-same-origin” is not recommended, because it effectively enables an embedded page to break out of all sandboxing.

The sandbox attribute is used with the iframe element to isolate the content of the embedded document from the rest of the page. It helps prevent malicious code from running on your website. However, the value assigned to the sandbox attribute in your iframe element includes both the allow-scripts and allow-same-origin options. This combination essentially removes all the protections that the sandbox attribute provides and allows the embedded document to break out of the sandbox.

To fix this issue, you should remove the allow-scripts and allow-same-origin values from the sandbox attribute. Instead, you should explicitly enable only the permissions that the embedded document requires.

Here’s an example iframe element with the proper use of sandbox:

<iframe src="https://example.com" sandbox="allow-forms allow-popups"></iframe>

This iframe element loads the https://example.com URL and has its sandbox attribute set to only allow-forms and allow-popups. This explicitly enables only the permissions that the embedded document may need, while also retaining the protections of the sandbox attribute.

Bad value X for attribute “src” on element “iframe”: Illegal character in query: “[” is not allowed.

The src attribute contains square brackets ([ or ]) in the URL’s query string, which are not permitted in valid HTML URLs.

According to the HTML standard, attribute values such as URLs must conform to valid URI syntax. Unencoded square brackets are reserved characters in URI syntax and must be percent-encoded. Specifically, [ should be replaced with %5B and ] with %5D. This ensures the URL is correctly interpreted by browsers and validators. For example, a URL parameter like sort=[asc] should be coded as sort=%5Basc%5D.

Correct HTML Example:

<iframe src="/page?time=%5Btimestamp%5D"></iframe>

Always encode reserved characters in URLs when using them in HTML attribute values to ensure W3C compliance.

Ready to validate your sites?
Start your free trial today.

Pro Trial Free Trial