i need to avoid things like this: http://www.thespanner.co.uk/2007/11/26/ultimate-xss-css-injection/ but have yet found a valid solution... anyone got any ideas?