Allow only simple, self-contained CSS values in style attributes. Anything that could open a new declaration, call url() or smuggle script is rejected outright rather than escaped.
Allow only simple, self-contained CSS values in style attributes. Anything that could open a new declaration, call url() or smuggle script is rejected outright rather than escaped.