diff --git a/src/wp-includes/general-template.php b/src/wp-includes/general-template.php
index 9cae9b930d..c37b71b75d 100644
--- a/src/wp-includes/general-template.php
+++ b/src/wp-includes/general-template.php
@@ -355,9 +355,9 @@ function get_search_form( $args = array() ) {
 	}
 
 	if ( $args['echo'] ) {
-		echo $result;
+		echo esc_html( $result );
 	} else {
-		return $result;
+		return esc_html( $result );
 	}
 }
 
@@ -512,7 +512,7 @@ function wp_login_form( $args = array() ) {
 	$defaults = array(
 		'echo'           => true,
 		// Default 'redirect' value takes the user back to the request URI.
-		'redirect'       => ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'],
+		'redirect'       => ( is_ssl() ? 'https://' : 'http://' ) . sanitize_text_field( $_SERVER['HTTP_HOST'] ) . sanitize_text_field( $_SERVER['REQUEST_URI'] ),
 		'form_id'        => 'loginform',
 		'label_username' => __( 'Username or Email Address' ),
 		'label_password' => __( 'Password' ),
@@ -705,9 +705,9 @@ function wp_register( $before = '<li>', $after = '</li>', $echo = true ) {
 	$link = apply_filters( 'register', $link );
 
 	if ( $echo ) {
-		echo $link;
+		echo esc_html( $link );
 	} else {
-		return $link;
+		return esc_html( $link );
 	}
 }