Allowing arbitrary insertion of iframes (or javascript) is very insecure and by default Elgg will filter them out.  What is usually done in this case is something similar to an SQL prepared query.  You have an input box for the user to enter his character's name (or id, or however the iframe's address differentiates the characters) and upon output display the hard-coded URL with the character name inserted into the correct spot.

For the second question, change the input type from longtext to text and it will not have TinyMCE.

Thank you very much for the response Brett, I'll have a play as soon as I get back home