Ticket #43723: 43723_sanitize_html_class.patch

wp-admin/user-edit.php

@@ -526 +526 @@
         <?php
         foreach ( wp_get_user_contact_methods( $profileuser ) as $name => $desc ) {
         ?>
-        <tr class="user-<?php echo $name; ?>-wrap">
-<th><label for="<?php echo $name; ?>">
+        <tr class="user-<?php echo sanitize_html_class($name); ?>-wrap">
+  <th><label for="<?php echo esc_attr($name); ?>">
         <?php
         /**
          * Filters a user contactmethod label.
@@ -542 +542 @@
         echo apply_filters( "user_{$name}_label", $desc );
         ?>
         </label></th>
-        <td><input type="text" name="<?php echo $name; ?>" id="<?php echo $name; ?>" value="<?php echo esc_attr( $profileuser->$name ); ?>" class="regular-text" /></td>
+        <td><input type="text" name="<?php echo esc_attr($name); ?>" id="<?php echo esc_attr($name); ?>" value="<?php echo esc_attr( $profileuser->$name ); ?>" class="regular-text" /></td>
         </tr>
         <?php
         }