There are no cookies to be stolen on csszengarden.com so this doesn’t really apply in this case but I agree it would be good to check this.

To allow all possible [JavaScript identifiers](http://mathiasbynens.be/notes/javascript-identifiers), we’d need quite the regular expression: [http://stackoverflow.com/a/9337047/96656](http://stackoverflow.com/a/9337047/96656) (the JS version of the regex would be 11,236 characters long)

Perhaps a simple `[a-zA-Z$_]` check would suffice?