id attributes populated by comment_ID() are not escaped

[kwight]

The core comment templates use comment_ID() to help populate some id attributes. comment_ID() is filterable, and should be escaped.

[nacin]

If I had my way, get_comment_ID() wouldn't have a filter. (get_the_ID() doesn't have one either.) That said, it returns an integer. So we can/should either cast to an integer inside get_comment_ID(), or just assume that plugin authors won't return something other than an integer.

[obenland]

New patch casts get_comment_ID() filter value to an integer.

[nacin]

This may actually be a breaking change along the lines of #22324.

[kwight]

Does that mean we should go back to the ​original patch?

[nacin]

Replying to kwight:

Does that mean we should go back to the ​original patch?

I think it's actually probably a wontfix.