Yeah, agreed Gareth. Unless people start putting private information inside sandboxed scripts (I dont think so but.. could happen) this is the safest approach.. At least safer than HTML. Greetings!! -- Eduardo http://www.sirdarckcat.net/ Sent from Hangzhou, Zhejiang, China On Wed, Jan 27, 2010 at 9:08 PM, gaz Heyes <gazheyes@gmail.com> wrote: > 2010/1/27 sird@rckc.at <sird@rckc.at> > >> a <script src=> inside an <iframe sandbox=> is the same as a <sandbox >> src=>, the difference is that the later is only javascript, and the former >> is JS and HTML (and css maybe). >> >> If I understood correctly, Helen things that HTML is dangerous, since it >> executes in the context of the page serving it, while JS by itself is not.. >> > > Actually it's a better solution:- > <sandbox src=x>Not supported</sandbox> > > The iframe content will not be displayed to the user. It makes more sense > to use a new element IMO as you can use alternative HTML within the element > boundaries >
Received on Wednesday, 27 January 2010 13:18:20 UTC