iframe srcdoc

HTML

<!DOCTYPE HTML>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title></title>
</head>
<body>
    <script type="text/javascript">
        var iframe = document.createElement('iframe');
        iframe.sandbox = ''
        data="1<script>console.log('hi') </script" +">"
        iframe.setAttribute(
                'srcdoc',
                data
        );
        document.body.appendChild(iframe);
    </script>
</body>
</html>