Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Does anyone have any idea how to sanitize CSS entered via user input? I am concerned about cross-site scripting via CSS. I am using wp_filter_kses to clean up user entered HTML, but I need a like solution for user entered styles. So far I am using the following ugly and incomplete function but I'd like something more complete.

function sanitizeCSS ( $css ) {
    $css = str_replace( '/-moz-binding/', '', $css );
    $css = str_replace( '/expression/', '', $css );
    $css = str_replace( '/javascript/', '', $css );
    $css = str_replace( '/vbscript/', '', $css );
    return $css; 
share|improve this question
What is the context here? Who is entering the CSS? If it's the owner of the site, they can attack their own site via XSS in other ways ... –  EAMann Jun 1 '12 at 17:31
It is the administrator, and I agree, but $_POST could be compromised between what the admin enters, and what actually gets committed to the database. The admin area is the most vulnerable to CSRF. –  radiok Jun 1 '12 at 17:50
@radiok Isn't that partly what nonces are for? Might be better to implement some kind of nonce or CSRF token checking mechanism than to sanitize every posted value. –  MathSmath Jun 1 '12 at 18:48
I do agree, but if you look at something simple, like Blog Name. Nonce's are used on the settings page, then before commit sanitize_text is applied to the value. I'm just trying to live up to the same principles of WordPress core, the problem is, WordPress has no need for CSS sanitization, since there's absolutely no where you can enter your own CSS. You could have a CSS file, but that's not vulnerable in the same way, since you authored that file. I digress, the only complete solution I've found is CSSTidy, but I can't easily incorporate that into a plugin. –  radiok Jun 1 '12 at 18:54

2 Answers 2

You’ll a need a real CSS parser like this one to filter the CSS. Regular expressions or simple string replacements are not safe enough.

share|improve this answer

Well, if you want the 50mm-barrel gun approach, you could use wp_filter_nohtml_kses(), but there may be better ways.

share|improve this answer
I don't think that would remove potentially bad css like -moz-binding, but I will I will have to look harder at that function's code. –  radiok Jun 1 '12 at 18:55
WordPress might not have a CSS-specific sanitization function. You might have to roll your own. –  Chip Bennett Jun 1 '12 at 19:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.