Allowed >, ", ' in some style modifier fields. Remove all <, script and expression.