The sandbox attribute in iframes restricts embedded content to enhance security by default; 1. It blocks scripts, form submissions, and DOM access unless explicitly allowed; 2. Permissions like allow-scripts, allow-forms, and allow-same-origin can selectively relax restrictions; 3. Common use cases include embedding untrusted content such as user-generated HTML, ads, or code demos; 4. Even trusted sources should be sandboxed to prevent potential attacks; 5. The attribute acts as a safe mode, where only permitted actions are allowed, effectively mitigating risks like XSS and unauthorized navigation, ensuring safer integration of third-party content.
The sandbox
attribute for <iframe></iframe>
elements is a security feature in HTML that restricts the actions of the embedded content within the iframe. It helps protect your webpage from potentially untrusted or third-party content by limiting what that content can do, such as running scripts, submitting forms, or accessing the parent page's DOM.

When you add the sandbox
attribute to an <iframe></iframe>
, the browser applies a set of restrictions to the iframe's content. By default, the content is treated as if it comes from a unique origin and is denied access to most APIs and features.
How It Works
<iframe src="https://example.com" sandbox></iframe>
In this example, the iframe content is heavily restricted. However, you can selectively relax certain restrictions by adding values to the sandbox
attribute.

Common Sandbox Permissions (allowable values)
You can allow specific behaviors by including tokens in the attribute:
allow-forms
– Allows form submission.allow-scripts
– Enables JavaScript execution.allow-same-origin
– Treats the content as being from the same origin (if it actually is), allowing access to storage and cookies.allow-top-navigation
– Permits the iframe to navigate the top-level browsing context (i.e., change the page URL).allow-popups
– Allows the iframe to open new windows (e.g., withwindow.open()
).allow-pointer-lock
– Allows pointer lock API usage.allow-orientation-lock
– Permits screen orientation locking.allow-presentation
– Allows triggering presentations (e.g., fullscreen slideshows).allow-downloads
– Enables download actions from the iframe.
Example with Multiple Permissions
<iframe src="https://example.com" sandbox="allow-scripts allow-same-origin allow-forms"> </iframe>
This allows the iframe to run scripts, submit forms, and be treated as same-origin — but still blocks popups and navigation.

Important Notes
- If
allow-same-origin
is used, make sure the content is trusted — otherwise, it could bypass same-origin policy protections. - Without
allow-scripts
, JavaScript in the iframe won’t run. - Without
allow-top-navigation
, malicious content can't redirect your main page. - The sandbox applies even if the iframe source is from a trusted domain.
Use Cases
- Embedding user-generated content (e.g., comments with HTML).
- Displaying third-party ads or widgets.
- Running untrusted code demos or playgrounds.
Using the sandbox
attribute is a simple but effective way to reduce the risk of XSS or unwanted behavior from embedded content.
Basically, it’s like putting the iframe in a "safe mode" — you decide what it's allowed to do.
The above is the detailed content of What is the sandbox attribute for elements?. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

The way to add drag and drop functionality to a web page is to use HTML5's DragandDrop API, which is natively supported without additional libraries. The specific steps are as follows: 1. Set the element draggable="true" to enable drag; 2. Listen to dragstart, dragover, drop and dragend events; 3. Set data in dragstart, block default behavior in dragover, and handle logic in drop. In addition, element movement can be achieved through appendChild and file upload can be achieved through e.dataTransfer.files. Note: preventDefault must be called

The reason why ARIA and HTML5 semantic tags are needed is that although HTML5 semantic elements have accessibility meanings, ARIA can supplement semantics and enhance auxiliary technology recognition capabilities. For example, when legacy browsers lack support, components without native tags (such as modal boxes), and state updates need to be dynamically updated, ARIA provides finer granular control. HTML5 elements such as nav, main, aside correspond to ARIArole by default, and do not need to be added manually unless the default behavior needs to be overridden. The situations where ARIA should be added include: 1. Supplement the missing status information, such as using aria-expanded to represent the button expansion/collapse status; 2. Add semantic roles to non-semantic tags, such as using div role to implement tabs and match them

The security risks of HTML5 applications need to be paid attention to in front-end development, mainly including XSS attacks, interface security and third-party library risks. 1. Prevent XSS: Escape user input, use textContent, CSP header, input verification, avoid eval() and direct execution of JSON; 2. Protect interface: Use CSRFToken, SameSiteCookie policies, request frequency limits, and sensitive information to encrypt transmission; 3. Secure use of third-party libraries: periodic audit dependencies, use stable versions, reduce external resources, enable SRI verification, ensure that security lines have been built from the early stage of development.

HTML5, CSS and JavaScript should be efficiently combined with semantic tags, reasonable loading order and decoupling design. 1. Use HTML5 semantic tags, such as improving structural clarity and maintainability, which is conducive to SEO and barrier-free access; 2. CSS should be placed in, use external files and split by module to avoid inline styles and delayed loading problems; 3. JavaScript is recommended to be introduced in front, and use defer or async to load asynchronously to avoid blocking rendering; 4. Reduce strong dependence between the three, drive behavior through data-* attributes and class name control status, and improve collaboration efficiency through unified naming specifications. These methods can effectively optimize page performance and collaborate with teams.

Using HTML5 semantic tags can improve web structure clarity, accessibility and SEO effects. 1. Semantic tags such as,,,, and make it easier for the machine to understand the page content; 2. Each tag has a clear purpose: used in the top area, wrap navigation links, include core content, display independent articles, group relevant content, place sidebars, and display bottom information; 3. Avoid abuse when using it, ensure that only one per page, avoid excessive nesting, reasonable use and in blocks. Mastering these key points can make the web page structure more standardized and practical.

Common reasons why HTML5 videos don't play in Chrome include format compatibility, autoplay policy, path or MIME type errors, and browser extension interference. 1. Videos should be given priority to using MP4 (H.264) format, or provide multiple tags to adapt to different browsers; 2. Automatic playback requires adding muted attributes or triggering .play() with JavaScript after user interaction; 3. Check whether the file path is correct and ensure that the server is configured with the correct MIME type. Local testing is recommended to use a development server; 4. Ad blocking plug-in or privacy mode may prevent loading, so you can try to disable the plug-in, replace the traceless window or update the browser version to solve the problem.

Embed web videos using HTML5 tags, supports multi-format compatibility, custom controls and responsive design. 1. Basic usage: add tags and set src and controls attributes to realize playback functions; 2. Support multi-formats: introduce different formats such as MP4, WebM, Ogg, etc. through tags to improve browser compatibility; 3. Custom appearance and behavior: hide default controls and implement style adjustment and interactive logic through CSS and JavaScript; 4. Pay attention to details: Set muted and autoplay to achieve automatic playback, use preload to control loading strategies, combine width and max-width to achieve responsive layout, and use add subtitles to enhance accessibility.

HTML5Canvas is suitable for web graphics and animations, and uses JavaScript to operate context drawing; ① First add canvas tags to HTML and get 2D context; ② Use fillRect, arc and other methods to draw graphics; ③ Animation is achieved by clearing the canvas, redrawing, and requestAnimationFrame loops; ④ Complex functions require manual processing of event detection, image drawing and object encapsulation.
