Settings API output is not escaped

[johnjamesjacoby]

Problem

The output from do_settings_sections() and do_settings_fields() is not escaped while looping through the $wp_settings_fields global.

---

Unescaped Variables

• $section['title']
• $field['args']['label_for']
• $field['title']

---

Solutions

• Escape everything. We shouldn't expect anyone that's using add_settings_section() and add_settings_field() to pass already escaped output. Note that core does not escape it's own usage here.
• Escape nothing, and expect escaped input. This would require developer education to escape all of the things.

---

Patch Attached

Attached patch escapes all variable screen output.

[nacin]

So, for things like programmatic values, we don't escape for security. Inner HTML should not be escaped. But, attributes should always be escaped to avoid breakage. So most of this looks great.

[johnjamesjacoby]

esc_attr() only, to allow title's to include HTML

[ryan]

In 22373:

Use esc_attr() for attributes. Props johnjamesjacoby. fixes #22327