Securing user inputted CSS data.

[EXreaction]

For a system I am working on it allows users to post their own CSS data to customize the page style for all users who see their page (I guess, kinda like how MySpace has it).

Currently I am having it do a few things:
Replace ", <, > with &quot;, &lt;, &gt;
Remove the words java and script

I am not sure if this is completely secured yet. I am mostly afraid of ways for users to have the word javascript in there that would not get replaced by the filter, yet still be rendered by the browser. For example, I found out that java\nscript would work on IE, but my current filter will work against that, I am just worried there may be more.