$product_id should be inside absint(), $classes should be inside sanitize_html_class();