Does anyone have any idea how to sanitize CSS entered via user input? I am concerned about cross-site scripting via CSS. I am using wp_filter_kses to clean up user entered HTML, but I need a like solution for user entered styles. So far I am using the following ugly and incomplete function but I’d like something more complete.
function sanitizeCSS ( $css ) {
$css = str_replace( '/-moz-binding/', '', $css );
$css = str_replace( '/expression/', '', $css );
$css = str_replace( '/javascript/', '', $css );
$css = str_replace( '/vbscript/', '', $css );
return $css;
}