Data attributed should be escaped with esc_attr()

On Thu, May 9, 2013 at 1:21 PM, Joe Hoyle <notifications@github.com>
wrote:

>>  <?php }
>>  
>>  function hma_user_avatar( $user_id, $width, $height, $crop = true ) { ?>
>> -	<img src="<?php echo hma_get_avatar( $user_id, $width, $height, $crop ); ?>" width="<?php echo $width; ?>" height="<?php echo $height; ?>" class="avatar" />
>> +	<img src="<?php echo esc_attr( hma_get_avatar( $user_id, $width, $height, $crop ) ); ?>" width="<?php echo esc_attr( $width ); ?>" height="<?php echo esc_attr( $height ); ?>" class="avatar" />
> @danielbachhuber is it necessary to pass data through `esc_attr` and `esc_url` for a `src` attribute?
> ---
> Reply to this email directly or view it on GitHub:
> https://github.com/humanmade/hm-accounts/pull/1/files#r4160494