public static function css($string)
    {
        $string = preg_replace_callback('#[^a-zA-Z0-9]#Su', function ($matches) {
            $char = $matches[0];
            // \xHH
            if (!isset($char[1])) {
                $hex = ltrim(strtoupper(bin2hex($char)), '0');
                if (0 === strlen($hex)) {
                    $hex = '0';
                }
                // Using a two character escape can cause problems if the next character continues the escape sequence.
                // There is a solution - add a space after the CSS escape (will be ignored by the CSS parser)
                return '\\' . $hex . ' ';
            }
            // \uHHHH
            $char = iconv('UTF-8', 'UTF-16BE', $char);
            return '\\' . ltrim(strtoupper(bin2hex($char)), '0') . ' ';
        }, $string);

        return $string;
    }
public static function css($string)
    {
        $string = preg_replace_callback('#[^a-zA-Z0-9]#Su', function ($matches) {
            $char = $matches[0];
            // \xHH
            if (!isset($char[1])) {
                $hex = ltrim(strtoupper(bin2hex($char)), '0');
                if (0 === strlen($hex)) {
                    $hex = '0';
                }
                // Using a two character escape can cause problems if the next character continues the escape sequence.
                // There is a solution - add a space after the CSS escape (will be ignored by the CSS parser)
                return '\\' . $hex . ' ';
            }
            // \uHHHH
            $char = iconv('UTF-8', 'UTF-16BE', $char);
            return '\\' . ltrim(strtoupper(bin2hex($char)), '0') . ' ';
        }, $string);

        return $string;
    }
public static function css ( $ string ) { $ string = preg_replace_callback ( '#[^a-zA-Z0-9]#Su' , function ( $ matches ) { $ char = $ matches [ 0 ] ; // \xHH if ( ! isset ( $ char [ 1 ] ) ) { $ hex = ltrim ( strtoupper ( bin2hex ( $ char ) ) , '0' ) ; if ( 0 === strlen ( $ hex ) ) { $ hex = '0' ; } // Using a two character escape can cause problems if the next character continues the escape sequence. // There is a solution - add a space after the CSS escape (will be ignored by the CSS parser) return '\\' . $ hex . ' ' ; } // \uHHHH $ char = iconv ( 'UTF-8' , 'UTF-16BE' , $ char ) ; return '\\' . ltrim ( strtoupper ( bin2hex ( $ char ) ) , '0' ) . ' ' ; } , $ string ) ; return $ string ; }
Escapes untrusted data for inserting into a property value

<style>selector { property : ...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...; } </style>
<style>selector { property : "...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE..."; } </style>
<span style="property : ...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...">text</span>

Per QWASP:
It's important that you only use untrusted data in a property value and not into other places in style data.
You should stay away from putting untrusted data into complex properties like url, behavior, and custom (-moz-binding).
You should also not put untrusted data into IE’s expression property value which allows JavaScript.
Please note there are some CSS contexts that can never safely use untrusted data as input - EVEN IF PROPERLY CSS ESCAPED!
You will have to ensure that URLs only start with "http" not "javascript" and that properties never start with "expression".

@param string $string Untrusted data

@return string Escaped data for inserting into a property value
Escapes untrusted data for inserting into a property value