Is there a security threat if I enable a user to add CSS?

Question

Is it not secure to enable user to add his own rules of CSS to his personal page, in (for example) a social website ?

Answer 1

It is not secure. There are multiple ways to embed JavaScript in CSS such that it gets executed by at least some browsers. Google "XSS CSS" and look through the top hits.

Don't do this unless you're willing to do hardcore sanitization of the CSS, and to clean up the mess when your sanitization is inevitably bypassed and your users' cookies are compromised.