Improve sanitization and add escaping for anchor_class and anchor_text

[westonruter]

strip_tags is not sufficient. Someone could enter double quote character and add entirely new attributes to the input element, or simply break the markup. So esc_attr is needed in both cases.

https://github.com/kienstra/widget-live-editor/blob/a1164d0c68bf141a6fb780a072854a7c1039f8fc/includes/wle-options.php#L38-L64

[kienstra]

Thanks, Weston. I'll change strip_tags() to esc_attr() I will also change the spaces to tabs.

[westonruter]

Actually, it's fine to leave strip_tags where they are. But adding esc_attr is the key thing to add, and should be right where it does echo. http://vip.wordpress.com/documentation/best-practices/security/validating-sanitizing-escaping/#always-escape-late

[kienstra]

Thank you, I'll add the esc_attr call at the echo line.

[westonruter]

:+1: