custom css fixed sanitization at php and js levels