Q:

Restricting script execution in CSS

I'm writing a rails app which allows user inputted CSS rules, and I want to restrict script execution.  Is disallowing 'binding' (for -moz-binding) and 'behavior' enough?  It would be implemented with a simple regex called before save.
Are there other methods of including scripts into css stylesheets?

A:

It's been proven, time and time again, that blacklisting doesn't work. Keep a whitelist of CSS you can safely allow. 

