improperly sanitized attributes in ms-options.php and ms-sites.php

[Denis-de-Bernardy]

We've things such as:

<input name="dashboard_blog_orig" type="hidden" id="dashboard_blog_orig" value="<?php echo $blogname; ?>" />

they ought to use esc_attr()

and textarea fields ought to use esc_html()

there are plenty more in ms-sites.php

(In [12617]) Add esc_attr to ms-sites.php. see #11782

(In [12619]) Add esc_attr to ms-options.php. see #11782

Appears handled.