Why is the <style> block considered unsafe markup?

Question

I recently hooked up PageDown to sanitize some of the HTML inputs coming from a text box, and noticed that it truncates the style elements,

I'm just wondering why they are considered unsafe?

Answer 1

IE has a special CSS function that allows you to embed JavaScript in CSS . That alone would be sufficient reason to ban tags <style>.

Expressions

behavior: style, style whitelist, . , script , .

, , CSS. , , (, <form>), , .

Answer 2

, <script> , , , , <style>. .

: http://www.squarefree.com/securitytips/web-developers.html

, , HTML-, , Firefox IE:

javascript:, vbscript:, and data: URLs in links, images, anywhere.
<script> tags, with or without src attributes.
Event attributes (on*), which contain scripts.
-moz-binding: or behavior: CSS properties inside <style> elements or style attributes.
HTML is that is not "well-formed" -- you can't be sure how quirky browsers will parse it. (Example: <b <i>Foo)

Answer 3

. ( , .). , , 3D-. ( , , CSS, , .)

( HTML4 style head. HTML5 , , css, , .)

Answer 4

- HTML-, , (.. , , ), . HTML ; , <stuff>, ?

... , . , iframe .., CSS / . ( HTML5 , , IE8, - . , .) , CSS, . (, behavior IE). , HTML, , . , -, ... , , .