Customizable sanitizer

Did the sanitized html worked?

I think that the sanitizer escaped the query string from src of the iframe (this link did not worked when I accessed in my browser):
```
src="https://w.soundcloud.com/player/?url&#61;https%3A//api.soundcloud.com/tracks/119929315"
```
While the input was:
src="https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/119929315"