From 63d8fcb190c147130756a6ecfce3ae796f148caf Mon Sep 17 00:00:00 2001
From: Philip Arthur Moore <philip@pressbuild.com>
Date: Thu, 7 Aug 2014 11:07:50 +0700
Subject: [PATCH] Add escaping to custom header example. Make sure that proper
 attribute escaping is added into the example that's in the custom header
 include file. Since we're not including this in header.php, we should at
 least make sure that the example given is proper and passes WordPress Coding
 Standards checks. See #552 for context.

---
 inc/custom-header.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/custom-header.php b/inc/custom-header.php
index 37aa8e2f..289129db 100644
--- a/inc/custom-header.php
+++ b/inc/custom-header.php
@@ -7,7 +7,7 @@
 
 	<?php if ( get_header_image() ) : ?>
 	<a href="<?php echo esc_url( home_url( '/' ) ); ?>" rel="home">
-		<img src="<?php header_image(); ?>" width="<?php echo get_custom_header()->width; ?>" height="<?php echo get_custom_header()->height; ?>" alt="">
+		<img src="<?php header_image(); ?>" width="<?php echo esc_attr( get_custom_header()->width ); ?>" height="<?php echo esc_attr( get_custom_header()->height ); ?>" alt="">
 	</a>
 	<?php endif; // End header image check. ?>