HTML Validation

Bad value X for attribute “src” on element “iframe”: Illegal character in query: “[” is not allowed.

About This HTML Issue

The src attribute contains square brackets ([ or ]) in the URL’s query string, which are not permitted in valid HTML URLs.

According to the HTML standard, attribute values such as URLs must conform to valid URI syntax. Unencoded square brackets are reserved characters in URI syntax and must be percent-encoded. Specifically, [ should be replaced with %5B and ] with %5D. This ensures the URL is correctly interpreted by browsers and validators. For example, a URL parameter like sort=[asc] should be coded as sort=%5Basc%5D.

Correct HTML Example:

<iframe src="/page?time=%5Btimestamp%5D"></iframe>

Always encode reserved characters in URLs when using them in HTML attribute values to ensure W3C compliance.

Last reviewed: May 05, 2025

Was this guide helpful?

Find issues like this automatically

Rocket Validator scans thousands of pages in seconds, detecting HTML issues across your entire site.

Start Free Trial See Pricing

Related W3C Validator Issues

Bad value X for attribute “name” on element “iframe”: Browsing context name started with the underscore.

The value of the name attribute on an <iframe> should not start with an underscore (_).

Browsing context names that begin with an underscore are reserved keywords in HTML, like _blank, _self, _parent, and _top. Using these reserved names or any custom name starting with an underscore for the name attribute of an <iframe> can lead to unexpected behavior and is considered invalid HTML.

Here’s how to fix the issue:

Problematic Code

<iframe src="https://example.com" name="_example"></iframe>

Solution

To resolve this issue, you should use a valid value for the name attribute that does not start with an underscore.

Corrected Code

<iframe src="https://example.com" name="example"></iframe>

Steps:

Identify the iframe element with the invalid name attribute value that starts with an underscore.
Replace the name value with a valid identifier that does not start with _. Use letters, numbers, hyphens (-), and underscores (_) (but not at the beginning).

Bad value for attribute “src” on element “iframe”: Illegal character in query: “[” is not allowed.

Illegal character “[” in the iframe src URL requires percent-encoding or removal.

The iframe element’s src must be a valid URL. According to URL syntax, characters like [ and ] are not allowed in the query unless percent-encoded. If your src contains array-like parameters (e.g., filters[category]=news), encode reserved characters: [ becomes %5B and ] becomes %5D. Avoid spaces and encode other reserved characters as needed. Alternatively, adjust the server to accept dot or bracketless notation (e.g., filters.category=news or filters_category=news) so the URL stays valid without encoding.

HTML Examples

Example causing the validator error

<!DOCTYPE html>
<html lang="en">
<head>
  <title>Iframe URL Error</title>
</head>
<body>
<!-- [ and ] are illegal in URLs unless encoded -->

  <iframe src="https://example.com/embed?filters[category]=news&filters[tags]=web"></iframe>
</body>
</html>

Fixed example with percent-encoding

<!DOCTYPE html>
<html lang="en">
<head>
  <title>Iframe URL Fixed</title>
</head>
<body>
<!-- Encode [ as %5B and ] as %5D -->

  <iframe src="https://example.com/embed?filters%5Bcategory%5D=news&filters%5Btags%5D=web"></iframe>
</body>
</html>

Bad value “” for attribute “(width|height)” on element “iframe”: The empty string is not a valid non-negative integer.

Bad value “X” for attribute “sandbox” on element “iframe”: Setting both “allow-scripts” and “allow-same-origin” is not recommended, because it effectively enables an embedded page to break out of all sandboxing.

The sandbox attribute is used with the iframe element to isolate the content of the embedded document from the rest of the page. It helps prevent malicious code from running on your website. However, the value assigned to the sandbox attribute in your iframe element includes both the allow-scripts and allow-same-origin options. This combination essentially removes all the protections that the sandbox attribute provides and allows the embedded document to break out of the sandbox.

To fix this issue, you should remove the allow-scripts and allow-same-origin values from the sandbox attribute. Instead, you should explicitly enable only the permissions that the embedded document requires.

Here’s an example iframe element with the proper use of sandbox:

<iframe src="https://example.com" sandbox="allow-forms allow-popups"></iframe>

This iframe element loads the https://example.com URL and has its sandbox attribute set to only allow-forms and allow-popups. This explicitly enables only the permissions that the embedded document may need, while also retaining the protections of the sandbox attribute.

The “longdesc” attribute on the “iframe” element is obsolete. Use a regular “a” element to link to the description.

The issue you’re encountering comes from using the longdesc attribute on an iframe element. The longdesc attribute was historically used to provide a URL to a long description of the content. However, it is now considered obsolete and should not be used. Instead, you should use a regular a (anchor) element to provide a link to the description.

Here’s a short guide on how to fix this issue:

Original Code with longdesc

<iframe src="video.html" longdesc="description.html" title="Video"></iframe>

Updated Code with Regular a Element

The recommended approach is to use a regular a element to provide a link to the description, like in the following example:

<iframe src="video.html" title="Video"></iframe>

<p>
  <a href="description.html">Long description of the video content</a>
</p>

Explanation

Original Code: The longdesc attribute is used on the iframe element, which is now obsolete.
Updated Code: We remove the longdesc attribute and provide an external link using the a element to guide users to the description.

Ready to validate your sites?
Start your free trial today.

Pro Trial Free Trial