title: xss attack through iframe src
body: <p>I am allowing users to embed a youtube or any other video source by only asking them to submit the <code>src</code> of the embed code they receive. Then I save it into the database and load it through an iframe. However,f there is a source, for instance, <code>src="http://innocent.com/hackingContent.php"</code>, then is my website vulenrable to an xss attack? </p>
  
  <p>I am estimating that the user may have a malicious script in that <code>src</code> which will load as soon as the iframe embeds the source into my own html.</p>
  
  <p><strong>EDIT</strong> What if the src contains <code>&lt;script type="text/javascript" src="evilScript.js"&gt;&lt;/script&gt;</code> . Although I <strong>am</strong> using a <code>preg_match</code> just to make sure that its a url only.</p>