Escape later when getting post and body classes

[mfields]

Both get_body_class() and get_post_class() provide filters that allow plugins and themes to add custom values to the list. These filters are applied after the values in the $classes array have been filtered through esc_attr(). I think that it would be best to move the escaping after the filter has fired.

esc_attr() was first added to get_body_class() and get_post_class() in [11838]

Makes sense.

Escape even later.

Looking at this again, it may be better to escape directly in body_class() and post_class() as shown in 20009.2.diff

Moving the escaping into body_class() isn't so good, because theme authors might use get_body_class() directly, without bothering to escape it's output. So 20009.diff​ looks good to me.

@scribu - Thanks for the input here. Both solutions make sense to me for different reasons. I agree that 20009.diff is the better of the two.

What exactly are we escaping here? Values added by plugins? Don't think escaping is really needed on class names added from trusted source, keep in mind that the HTML class attribute allows the whole UTF-8 charset to be used with very little restrictions.