title: HTML Purifier: allow user styling
body: <p>Our software recently got hit by XSS attacks through a feature that allows users to style their own posts using HTML and CSS.
  Is it possible to allow user styling of their own forum posts while sanitising anything else?</p>
  
  <p>This is the code we have so far:</p>
  
  <pre><code>require_once 'module/purifier/library/HTMLPurifier.auto.php';
  $config = HTMLPurifier_Config::createDefault();
  
  $config-&gt;set('Core.Encoding', 'ISO-8859-1');
  $config-&gt;set('HTML.Doctype', 'HTML 4.01 Transitional');
  $config-&gt;set('CSS.Trusted', true);
  $config-&gt;set('HTML.Allowed', 'style,div[id|class]');
  
  $purifier = new HTMLPurifier($config);
  ...
  echo $purifier-&gt;purify($uheader); // $uheader contains the CSS code wrapped between "style" tags and a "div" class.
  </code></pre>
  
  <p>However, while testing I still can't see my custom style applied.</p>
  
  <p><strong>UPDATE 1</strong></p>
  
  <p>As per request, the HTML code:</p>
  
  <pre><code>&lt;img src="test"onerror="alert('XSS TEST')"&gt;
  &lt;style&gt;
  CSS_CODE_HERE
  &lt;/style&gt;
  &lt;div class="mainbar1-1"&gt;
  </code></pre>
  
  <p>I added that "img src" tag just to make sure that one gets filtered properly.</p>