From 3eabc7db5a5bf37d9afe0837d2a349ab9962371f Mon Sep 17 00:00:00 2001
From: Ryan Boren <ryan@boren.nu>
Date: Mon, 5 Nov 2012 18:04:50 +0000
Subject: [PATCH] Use esc_attr() for attributes. Props johnjamesjacoby. fixes
 #22327

git-svn-id: http://core.svn.wordpress.org/trunk@22373 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/includes/template.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wp-admin/includes/template.php b/wp-admin/includes/template.php
index 31a1ebf252..c5fa7a1b12 100644
--- a/wp-admin/includes/template.php
+++ b/wp-admin/includes/template.php
@@ -1113,7 +1113,7 @@ function do_settings_fields($page, $section) {
 	foreach ( (array) $wp_settings_fields[$page][$section] as $field ) {
 		echo '<tr valign="top">';
 		if ( !empty($field['args']['label_for']) )
-			echo '<th scope="row"><label for="' . $field['args']['label_for'] . '">' . $field['title'] . '</label></th>';
+			echo '<th scope="row"><label for="' . esc_attr( $field['args']['label_for'] ) . '">' . $field['title'] . '</label></th>';
 		else
 			echo '<th scope="row">' . $field['title'] . '</th>';
 		echo '<td>';