sanitize iframe url to prevent html/js injection