I am looking to render user-generated HTML within an iframe. I am wondering if I should either (or both) sanitize the markup with a library like:

https://github.com/apostrophecms/sanitize-html

or just use the sandbox property on the iframe like so:

<iframe sandbox="allow-popups" srcdoc="myMarkup" />

Is one of these solutions better than the other or do they both accomplish the same thing?