Add some security hardening to passed playlist attributes.

Props xknown.
See #26631.


Built from https://develop.svn.wordpress.org/trunk@27311


git-svn-id: http://core.svn.wordpress.org/trunk@27164 1a063a9b-81f0-0310-95a4-ce76da25c4cd