'Depending on the browser, stuff like ``e x p r e s s i o n(...)``
can get interpreted, or ``expre/* stuff */ssion(...)``.  This
checks for attempt to do stuff like this.
Typically the response will be to kill the entire style; if you
have just a bit of Javascript in the style another rule will catch
that and remove only the Javascript from the style; this catches
more sneaky attempts.'

def _has_sneaky_javascript(self, style):

    style = self._substitute_comments('', style)
    style = style.replace('\\', '')
    style = _substitute_whitespace('', style)
    style = style.lower()
    if ('javascript:' in style):
        return True
    if ('expression(' in style):
        return True
    return False
