diff --git a/templates/profile.html b/templates/profile.html
index 928c6c04..d3a612c3 100644
--- a/templates/profile.html
+++ b/templates/profile.html
@@ -1,13 +1,15 @@
 {% extends 'base.html' %}
 
 {% block pagetitle %}
-    Royal Games
+    {{ royal.username }}
 {% endblock %}
 
 {% block posthead %}
     {% if css %}
         <style>
-            {{ css.css }}
+            {% autoescape false %}
+                {{ css.css }}
+            {% endautoescape %}
         </style>
     {% endif %}
 {% endblock %}
diff --git a/webserver.py b/webserver.py
index 83815f84..020d71de 100644
--- a/webserver.py
+++ b/webserver.py
@@ -108,8 +108,12 @@ def page_setcss():
         if user_id is None:
             abort(403)
             return
+        css = request.form.get("css", "")
+        if "<style" in css:
+            abort(400)
+            return
         if ccss is None:
-            ccss = db.CustomCSS(royal_id=user_id, css=request.form.get("css", ""))
+            ccss = db.CustomCSS(royal_id=user_id, css=css)
             db_session.add(ccss)
         else:
             ccss.css = request.form.get("css", "")