title: Using iframe to display injected content
body: <p>I have a web application which has to display in some places HTML content that originates from external sources like for example email or that has been pasted in to other applications that ends up in the database i.e. I have little control of what the html contains.</p>
  
  <p>After trying different options the best way I can see to ensure the injected html doesn't cause conflicts with the application is to inject it into an iframe.</p>
  
  <p>My one concern is that in some edge cases there can be multiple iframe lets says 50 to 100.</p>
  
  <p>Is that number of iframes going to cause an issue with modern browsers?</p>
  
  <p>It's not  an issue as far as the amount of content is concerned because it is all going to be in the page one way or another, it's just a concern whether the iframe is too heavy element that may use too many resources to have in such large numbers.</p>
  
  <p><em>EDIT</em> 
  We are already using ajax to load the content, we have repeatedly tried to 'sanitise' the content but there always seems to be something we haven't allowed for, for example malformed html, input controls, even parts of our own application screens basically anything that someone could embed in an email.</p>
  
  <p>An iframe would allow us to isolate the content in its own document and not worry about it causing issues with the rest of the application.</p>
  
  <p>The need to have multiple iframes is because in one place we display a list of emails and don't have control over the number of such items displayed, even though generally the number is low there are a few edge cases where the number could be high. I guess we could virtualize the screen to reduce the number of iframe in existence at any one time.</p>
  
  <p>The alternative is to continue to try and fight with sanitising the content.</p>