You can entity-encode the content in the srcdoc= attribute to robustly solve that problem, or populate it via the DOM.