Does anyone have any idea how to sanitize CSS entered via user input? I am concerned about cross-site scripting via CSS. I am using wp_filter_kses to clean up user entered HTML, but I need a like solution for user entered styles. So far I am using the following ugly and incomplete function but I’d like something more complete.

function sanitizeCSS ( $css ) {
    $css = str_replace( '/-moz-binding/', '', $css );
    $css = str_replace( '/expression/', '', $css );
    $css = str_replace( '/javascript/', '', $css );
    $css = str_replace( '/vbscript/', '', $css );
    return $css; 
}

5 s
5

You’ll a need a real CSS parser like this one to filter the CSS. Regular expressions or simple string replacements are not safe enough.

Leave a Reply

Your email address will not be published. Required fields are marked *