I just remembered visiting a website that used iframe's with script tags disabled for users their signatures. It was a pretty interesting approach.

I just hope they used a proper lib like Purifier to do it, or someone's going to have fun with `onmouseover`.

I think that when it's sandboxed with the proper attributes, you can't do anything appart from trashing the content of the frame.

I had no clue that was so widely supported. No IE8/9 but virtually everything else. Neato! http://caniuse.com/#feat=iframe-sandbox