I would like to use this code
window.parent.document.getElementById(\'message\').value += \"\\r\\n\\r\\n[img]\"+response+\"[/img]\";
It works
As stated, this falls under same origin policy, but there are some tricks that allow limited communication with the iframe. Take a look at http://ajaxify.com/run/crossframe/