2b:null 2c:["$","title",null,{"children":"Using Sourceless iFrames | Michaël Guitton | Observable"}] 31:T4ba,html`

By including HTML inside a sourceless iFrame (as opposed to emitting it in the publisher’s document directly), you can prevent that content from breaking the surrounding structure (imagine what user-generated content like […] could do to the rest of the page). This makes sanitization easier. Instead of escaping HTML, potentially white-listing certain tags (i.e. <b> and <i>), and ensuring that all open tags are closed, you only have to escape the quotation mark character.

— Mike Pennisi, Third-Party JavaScript Development: The Future!

`32:T738,embed = { /*! * Many thanks to Fabian Iwand, Sylvain Lesage, Corey Goldfeder, Mike Pennisi, and Willem van der Veen! - mg */ const attr = "srcdoc"; const iframe = Object.assign(html`\n~~~","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":39,"value":"If the `srcdoc` attribute and the `src` attribute are both specified together, the `srcdoc` attribute takes priority.","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":38,"value":"This allows authors to provide a fallback URL for browsers that do not support the `srcdoc` attribute.","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":37,"value":"viewof sandbox = Inputs.toggle({ label: \"Enable sandbox\", value: false })","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":36,"value":"Object.assign(html`