diff --git a/src/wp-includes/admin-bar.php b/src/wp-includes/admin-bar.php
index 19322a3451..ddcbcdf007 100644
--- a/src/wp-includes/admin-bar.php
+++ b/src/wp-includes/admin-bar.php
@@ -463,7 +463,7 @@ function wp_admin_bar_customize_menu( $wp_admin_bar ) {
 		return;
 	}
 
-	$current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
+	$current_url = ( is_ssl() ? 'https://' : 'http://' ) . sanitize_text_field( $_SERVER['HTTP_HOST'] ) . sanitize_text_field( $_SERVER['REQUEST_URI'] );
 	if ( is_customize_preview() && $wp_customize->changeset_uuid() ) {
 		$current_url = remove_query_arg( 'customize_changeset_uuid', $current_url );
 	}
@@ -1198,7 +1198,7 @@ function wp_admin_bar_add_secondary_groups( $wp_admin_bar ) {
 function wp_admin_bar_header() {
 	$type_attr = current_theme_supports( 'html5', 'style' ) ? '' : ' type="text/css"';
 	?>
-<style<?php echo $type_attr; ?> media="print">#wpadminbar { display:none; }</style>
+<style<?php echo esc_attr( $type_attr ); ?> media="print">#wpadminbar { display:none; }</style>
 	<?php
 }
 
@@ -1210,7 +1210,7 @@ function wp_admin_bar_header() {
 function _admin_bar_bump_cb() {
 	$type_attr = current_theme_supports( 'html5', 'style' ) ? '' : ' type="text/css"';
 	?>
-<style<?php echo $type_attr; ?> media="screen">
+<style<?php echo esc_attr( $type_attr ); ?> media="screen">
 	html { margin-top: 32px !important; }
 	@media screen and ( max-width: 782px ) {
 		html { margin-top: 46px !important; }