crap. what's a reasonable approach to prevent malicious use? whitelist OR style="overflow:hidden" (http://jsbin.com/zekar/1 http://jsbin.com/zekar/1) OR someth

crap. what's a reasonable approach to prevent malicious use? whitelist OR style="overflow:hidden" (http://jsbin.com/zekar/1 http://jsbin.com/zekar/1) OR something else?