Ticket #43723: 43723.3.diff

src/wp-admin/user-edit.php

@@ -526 +526 @@
                 <?php
                 foreach ( wp_get_user_contact_methods( $profileuser ) as $name => $desc ) {
                         ?>
-        <tr class="user-<?php echo $name; ?>-wrap">
-<th><label for="<?php echo $name; ?>">
+        <tr class="user-<?php echo sanitize_html_class( $name ); ?>-wrap">
+<th><label for="<?php echo esc_attr( $name ); ?>">
                         <?php
                         /**
                          * Filters a user contactmethod label.
@@ -542 +542 @@
                         echo apply_filters( "user_{$name}_label", $desc );
                         ?>
         </label></th>
-        <td><input type="text" name="<?php echo $name; ?>" id="<?php echo $name; ?>" value="<?php echo esc_attr( $profileuser->$name ); ?>" class="regular-text" /></td>
+        <td><input type="text" name="<?php echo esc_attr( $name ); ?>" id="<?php echo esc_attr( $name ); ?>" value="<?php echo esc_attr( $profileuser->$name ); ?>" class="regular-text" /></td>
         </tr>
                         <?php
                 }