From d2aba8368936da30e2f1a6b73f5d05de1b6edfbb Mon Sep 17 00:00:00 2001
From: Ryan Boren <ryan@git.wordpress.org>
Date: Fri, 16 Mar 2007 01:20:53 +0000
Subject: [PATCH] More attribute_escape().

git-svn-id: https://develop.svn.wordpress.org/trunk@5044 602fd350-edb4-49c9-b593-d223f7449a82
---
 wp-includes/functions.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wp-includes/functions.php b/wp-includes/functions.php
index 084d1f45c5..3b571bce5e 100644
--- a/wp-includes/functions.php
+++ b/wp-includes/functions.php
@@ -1280,7 +1280,7 @@ function wp_nonce_ays($action) {
 	if ( $_POST ) {
 		$q = http_build_query($_POST);
 		$q = explode( ini_get('arg_separator.output'), $q);
-		$html .= "\t<form method='post' action='$pagenow'>\n";
+		$html .= "\t<form method='post' action='" . attribute_escape($pagenow) . "'>\n";
 		foreach ( (array) $q as $a ) {
 			$v = substr(strstr($a, '='), 1);
 			$k = substr($a, 0, -(strlen($v)+1));