parse & whitelist. Shouldn't be too bad, assuming you just throw out anything that even starts to look like bad input (make a super strict parser, and don't worry about css "hacks" like a real browser's parser would).