You're putting arbritary values in each tag - users can pass through anything there, including quotes. The size and font tags in particular allow spaces through, meaning users can legitimately place full HTML in those fields. This is very dangerous. I must insist that you pull down the hack and add validation.
Legal values for colors are always going to be a-zA-Z0-9 and #. Legal values for sizes are only going to be 0-9, +, and -. Fonts should be restricted to a-zA-Z0-9, and the comma. No spaces.
