I am looking to render user-generated HTML within an iframe. I am wondering if I should either (or both) sanitize the markup with a library like:
https://github.com/apostrophecms/sanitize-html
or just use the sandbox property on the iframe like so:
<iframe sandbox="allow-popups" srcdoc="myMarkup" />
Is one of these solutions better than the other or do they both accomplish the same thing?