Now I know people can hack my site pretty badly with XSS and other things so I came up with a few ways to prevent havoc:
When wanting to test out the code the data is sent from www.A.com to www.B.com
On that domain, the data is written to an iframe with the sandbox feature on without the "allow-top-navigation" option.
The iframe is then sent back to www.A.com
www.A.com receives iframe and appends it as a child into the DOM.
The user sees the iframe and can interact with it.
Is this secure enough? or am I missing something crucial?