HTML Purifier: allow user styling
<p>Our software recently got hit by XSS attacks through a feature that allows users to style their own posts using HTML and CSS.
Is it possible to allow user styling of their own forum posts while sanitising anything else?</p>

<p>This is the code we have so far:</p>

<pre><code>require_once 'module/purifier/library/HTMLPurifier.auto.php';
$config = HTMLPurifier_Config::createDefault();

$config-&gt;set('Core.Encoding', 'ISO-8859-1');
$config-&gt;set('HTML.Doctype', 'HTML 4.01 Transitional');
$config-&gt;set('CSS.Trusted', true);
$config-&gt;set('HTML.Allowed', 'style,div[id|class]');

$purifier = new HTMLPurifier($config);
...
echo $purifier-&gt;purify($uheader); // $uheader contains the CSS code wrapped between "style" tags and a "div" class.
</code></pre>

<p>However, while testing I still can't see my custom style applied.</p>

<p><strong>UPDATE 1</strong></p>

<p>As per request, the HTML code:</p>

<pre><code>&lt;img src="test"onerror="alert('XSS TEST')"&gt;
&lt;style&gt;
CSS_CODE_HERE
&lt;/style&gt;
&lt;div class="mainbar1-1"&gt;
</code></pre>

<p>I added that "img src" tag just to make sure that one gets filtered properly.</p>