diff --git a/templates/profile.html b/templates/profile.html
index dd67a638..d91997c0 100644
--- a/templates/profile.html
+++ b/templates/profile.html
@@ -7,7 +7,9 @@
 {% block posthead %}
     {% if css %}
         <style>
-            {{ css.css }}
+            {% autoescape false %}
+                {{ css.css }}
+            {% endautoescape %}
         </style>
     {% endif %}
 {% endblock %}
diff --git a/webserver.py b/webserver.py
index cffc671b..5f874ea1 100644
--- a/webserver.py
+++ b/webserver.py
@@ -107,8 +107,12 @@ def page_setcss():
         if user_id is None:
             abort(403)
             return
+        css = request.form.get("css", "")
+        if "<style" in css:
+            abort(400)
+            return
         if ccss is None:
-            ccss = db.CustomCSS(royal_id=user_id, css=request.form.get("css", ""))
+            ccss = db.CustomCSS(royal_id=user_id, css=css)
             db_session.add(ccss)
         else:
             ccss.css = request.form.get("css", "")