Can malicious javascript code be injected trough $()?
<p>Example:</p>

<pre><code>if($('#' + untrusted_js_code).length) &gt; 0
  ....`
</code></pre>

<p>Normally "untrusted_js_code" should be a simple string representing the ID of an item. The value of the variable comes from an iframe (trough postMessage), this is why it's untrusted. And I'm just checking if that item exists in the current page, and only then do stuff with it.</p>
