title: CSRF protection question
body: <p>I'm currently in the process of implementing CSRF protection into my framework (PHP).</p>
  
  <p>However I am wondering:</p>
  
  <p>Wouldn't it be possible for an attacker to load my page in a (hidden) iframe (obtaining the token) and change some data using JavaScript?</p>
  
  <p>And after that submitting the form?</p>