When adding the below style attribute on a popular website in IE7 emulator nothing happened, but when I execute it from a trivial website in IE7 emulator it does get executed.
<body style="width: expression(alert())">
How can you prevent the expression from being executed?
On
As a mitigation against JavaScript being injected in unexpected places in modern browsers, use a content security policy. For instance, a CSP of script-src: none; will deny all JavaScript execution within your page, regardless of where it originated. More nuanced policies can be designed to allow JavaScript only from specific URIs, or only scripts with specific hashes.
The feature you are talking about is called
Dynamic Propertiesand is no longer supported as of IE8.