I haven't seen anyone post a solution for a secure dynamic iFrame, so I figured I'd post mine.

I created a page that only has an iFrame module, and set its default URL to my home page.  In the settings page, I added this to my Footer:

<script language="javascript" type="text/javascript">
function getQuerystring(key, default_)
{
   if (default_==null) default_=""; 
  key = key.replace(/[\[]/,"\\\[").replace(/[\]]/,\\\]);
   var regex = new RegExp("[\\?&]"+key+"=([^&#]*)");
   var qs = regex.exec(window.location.href);
   if(qs == null)
     return default_;
   else
     return qs[1];
 }

  var URL; 
  switch (getQuerystring('id')) {
    case 'Google':
      URL = 'http://www.google.com’;
      break;
    case 'Facebook':
      URL = 'http://www.facebook.com’;
      break;
    default: window.location='/logoff.aspx';
  }
  $('iframe').attr('src',URL);
</script>

Then my URL would look like “/testpage.aspx?id=Google” or “/testpage.aspx?id=Facebook”.  The jQuery code will figure out which iFrame source to set.  If the user tries to hack it, they get logged off.

Is there a security hole I’m not seeing?