# Bad value X for attribute “src” on element “iframe”: Illegal character in query. Space is not allowed.

> Canonical HTML version: https://rocketvalidator.com/html-validation/bad-value-x-for-attribute-src-on-element-iframe-illegal-character-in-query-space-is-not-allowed
> Attribution: Rocket Validator (https://rocketvalidator.com)
> License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)

A space character in the `src` attribute of an `iframe` is not valid in a URL. Spaces must be percent-encoded as `%20` to produce a legal URL.

URLs follow the syntax rules defined in [RFC 3986](https://www.rfc-editor.org/rfc/rfc3986), which does not allow literal space characters anywhere in a URI, including the query string portion (the part after `?`). When the HTML validator encounters a raw space in a URL attribute like `src`, it flags the value as malformed.

This commonly happens when query parameter values contain readable text, or when a URL is copied from a browser's address bar where the browser displays decoded spaces for readability. The fix is to replace each space with `%20`.

Some developers use `+` instead of `%20` for spaces in query strings. The `+` convention originates from the `application/x-www-form-urlencoded` format used in HTML form submissions, and many servers accept it. However, `%20` is the correct encoding according to RFC 3986 and will pass W3C validation without issues.

## HTML examples

### Invalid: space in the query string

```html
<iframe
  src="https://example.com/embed?title=my page&lang=en"
  width="600"
  height="400">
</iframe>
```

### Valid: space encoded as `%20`

```html
<iframe
  src="https://example.com/embed?title=my%20page&lang=en"
  width="600"
  height="400">
</iframe>
```