diff --git a/src/wp-content/themes/twentythirteen/functions.php b/src/wp-content/themes/twentythirteen/functions.php
index 5d0b0a38d8..6dfd91b92b 100644
--- a/src/wp-content/themes/twentythirteen/functions.php
+++ b/src/wp-content/themes/twentythirteen/functions.php
@@ -146,7 +146,7 @@ function twentythirteen_fonts_url() {
 			'family' => urlencode( implode( '|', $font_families ) ),
 			'subset' => urlencode( 'latin,latin-ext' ),
 		);
-		$fonts_url = add_query_arg( $query_args, "//fonts.googleapis.com/css" );
+		$fonts_url = add_query_arg( $query_args, '//fonts.googleapis.com/css' );
 	}
 
 	return $fonts_url;
@@ -319,7 +319,7 @@ if ( ! function_exists( 'twentythirteen_entry_meta' ) ) :
  */
 function twentythirteen_entry_meta() {
 	if ( is_sticky() && is_home() && ! is_paged() )
-		echo '<span class="featured-post">' . __( 'Sticky', 'twentythirteen' ) . '</span>';
+		echo '<span class="featured-post">' . esc_html__( 'Sticky', 'twentythirteen' ) . '</span>';
 
 	if ( ! has_post_format( 'link' ) && 'post' == get_post_type() )
 		twentythirteen_entry_date();
@@ -413,7 +413,7 @@ function twentythirteen_the_attached_image() {
 		'post_type'      => 'attachment',
 		'post_mime_type' => 'image',
 		'order'          => 'ASC',
-		'orderby'        => 'menu_order ID'
+		'orderby'        => 'menu_order ID',
 	) );
 
 	// If there is more than 1 attachment in a gallery...
diff --git a/src/wp-content/themes/twentythirteen/inc/custom-header.php b/src/wp-content/themes/twentythirteen/inc/custom-header.php
index 61bc6aff7b..43ee3b287f 100644
--- a/src/wp-content/themes/twentythirteen/inc/custom-header.php
+++ b/src/wp-content/themes/twentythirteen/inc/custom-header.php
@@ -216,12 +216,15 @@ function twentythirteen_admin_header_style() {
  * @since Twenty Thirteen 1.0
  */
 function twentythirteen_admin_header_image() {
+	$style = 'color: #' . get_header_textcolor() . ';';
+	if ( ! display_header_text() ) {
+		$style = 'display: none;';
+	}
 	?>
-	<div id="headimg" style="background: url(<?php header_image(); ?>) no-repeat scroll top; background-size: 1600px auto;">
-		<?php $style = ' style="color:#' . get_header_textcolor() . ';"'; ?>
+	<div id="headimg" style="background: url(<?php echo esc_url( get_header_image() ); ?>) no-repeat scroll top; background-size: 1600px auto;">
 		<div class="home-link">
-			<h1 class="displaying-header-text"><a id="name"<?php echo $style; ?> onclick="return false;" href="#" tabindex="-1"><?php bloginfo( 'name' ); ?></a></h1>
-			<h2 id="desc" class="displaying-header-text"<?php echo $style; ?>><?php bloginfo( 'description' ); ?></h2>
+			<h1 class="displaying-header-text"><a id="name" style="<?php echo esc_attr( $style ); ?>" onclick="return false;" href="#" tabindex="-1"><?php bloginfo( 'name' ); ?></a></h1>
+			<h2 id="desc" class="displaying-header-text" style="<?php echo esc_attr( $style ); ?>"><?php bloginfo( 'description' ); ?></h2>
 		</div>
 	</div>
 <?php }
diff --git a/src/wp-content/themes/twentythirteen/taxonomy-post_format.php b/src/wp-content/themes/twentythirteen/taxonomy-post_format.php
index bbec0461d1..3f5825b202 100644
--- a/src/wp-content/themes/twentythirteen/taxonomy-post_format.php
+++ b/src/wp-content/themes/twentythirteen/taxonomy-post_format.php
@@ -20,7 +20,7 @@ get_header(); ?>
 
 		<?php if ( have_posts() ) : ?>
 			<header class="archive-header">
-				<h1 class="archive-title"><?php printf( __( '%s Archives', 'twentythirteen' ), '<span>' . get_post_format_string( get_post_format() ) . '</span>' ); ?></h1>
+				<h1 class="archive-title"><?php printf( __( '%s Archives', 'twentythirteen' ), '<span>' . esc_html( get_post_format_string( get_post_format() ) ) . '</span>' ); ?></h1>
 			</header><!-- .archive-header -->
 
 			<?php /* The loop */ ?>