You need to encode the url. You can do this by running this script:
prompt('Here is your completed code:',encodeURIComponent(prompt('Enter the url to encode','')));
You can try it out here: http://jsfiddle.net/zenr8/
The encoded URL that the script gives you is the thing you need to enter into the URL parameter. In your case, the iframe would look like this:
<iframe src="pan.htm?image=http%3A%2F%2Fsomeaddress.com%2Fimg1.jpg" ></iframe>
If you need to enter something in an URL parameter from a script, you should always make sure that it's properly encoded. You can do this by using encodeURIComponent. If you then need to decode it for further usage in your script, just use decodeURIComponent again. For example:
alert(encodeURIComponent('http://google.com/?hl=en&q=search'));
//alerts http%3A%2F%2Fgoogle.com%2F%3Fhl%3Den%26q%3Dsearch
alert(decodeURIComponent('http%3A%2F%2Fgoogle.com%2F%3Fhl%3Den%26q%3Dsearch'));
//alerts http://google.com/?hl=en&q=search