Usually with this type of situation, I hear people setting the upload site to a full different URL, and then including that url in an iframe on the main site.

Due to security reasons, the needed javascript code that would run and try to execute would only have access to the url of the upload site, and keep the sensative data on the display site safe and unaccessible.