diff --git a/wp-admin/admin-header.php b/wp-admin/admin-header.php
index 40ac358e72..4f5c1ad435 100644
--- a/wp-admin/admin-header.php
+++ b/wp-admin/admin-header.php
@@ -66,10 +66,12 @@ do_action('admin_head');
 </style>
 </noscript>
 <script type="text/javascript">
+//<![CDATA[
 (function(){
 	var ns = document.getElementsByTagName('noscript');
 	if ( ns && (ns = ns[0]) ) ns.parentNode.removeChild(ns);
 })();
+//]]>
 </script>
 
 <?php if ( $is_iphone ) { ?>
diff --git a/wp-includes/script-loader.php b/wp-includes/script-loader.php
index 3718f7c0e4..98b8b855e2 100644
--- a/wp-includes/script-loader.php
+++ b/wp-includes/script-loader.php
@@ -609,7 +609,7 @@ function _print_scripts() {
 
 		$ver = md5("$wp_scripts->concat_version");
 		$src = $wp_scripts->base_url . "/wp-admin/load-scripts.php?c={$zip}&load=" . trim($wp_scripts->concat, ', ') . "&ver=$ver";
-		echo "<script type='text/javascript' src='$src'></script>\n";
+		echo "<script type='text/javascript' src='" . attribute_escape($src) . "'></script>\n";
 	}
 
 	if ( !empty($wp_scripts->print_html) )
@@ -676,7 +676,7 @@ function print_admin_styles() {
 			$dir = $wp_styles->text_direction;
 			$ver = md5("$wp_styles->concat_version{$dir}");
 			$href = $wp_styles->base_url . "/wp-admin/load-styles.php?c={$zip}&dir={$dir}&load=" . trim($wp_styles->concat, ', ') . "&ver=$ver";
-			echo "<link rel='stylesheet' href='$href' type='text/css' media='all' />\n";
+			echo "<link rel='stylesheet' href='" . attribute_escape($href) . "' type='text/css' media='all' />\n";
 		}
 
 		if ( !empty($wp_styles->print_html) )