From 8206eb2975259303e8edd3e5b4e7a4c8e298bac1 Mon Sep 17 00:00:00 2001
From: Mark Jaquith <m@rkj.me>
Date: Fri, 30 Sep 2011 15:14:12 -0400
Subject: [PATCH] Some missed escaping points in widgets.

---
 widgets/widget-price_filter.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/widgets/widget-price_filter.php b/widgets/widget-price_filter.php
index c4196a896e2..0493e9bfe56 100644
--- a/widgets/widget-price_filter.php
+++ b/widgets/widget-price_filter.php
@@ -118,11 +118,11 @@ class WooCommerce_Widget_Price_Filter extends WP_Widget {
 		$fields = '';
 		
 		if (get_search_query()) $fields = '<input type="hidden" name="s" value="'.get_search_query().'" />';
-		if (isset($_GET['post_type'])) $fields .= '<input type="hidden" name="post_type" value="'.$_GET['post_type'].'" />';
+		if (isset($_GET['post_type'])) $fields .= '<input type="hidden" name="post_type" value="'.esc_attr( $_GET['post_type'] ).'" />';
 		
 		if ($_chosen_attributes) foreach ($_chosen_attributes as $attribute => $value) :
 		
-			$fields .= '<input type="hidden" name="'.str_replace('pa_', 'filter_', $attribute).'" value="'.implode(',', $value).'" />';
+			$fields .= '<input type="hidden" name="'.esc_attr( str_replace('pa_', 'filter_', $attribute) ).'" value="'.esc_attr( implode(',', $value) ).'" />';
 		
 		endforeach;
 		
@@ -139,13 +139,13 @@ class WooCommerce_Widget_Price_Filter extends WP_Widget {
 			)
 		)"));
 		
-		echo '<form method="get" action="'.$_SERVER['REQUEST_URI'].'">
+		echo '<form method="get" action="">
 			<div class="price_slider_wrapper">
 				<div class="price_slider"></div>
 				<div class="price_slider_amount">
 					<button type="submit" class="button">Filter</button>'.__('Price: ', 'woothemes').'<span></span>
-					<input type="hidden" id="max_price" name="max_price" value="'.$max.'" />
-					<input type="hidden" id="min_price" name="min_price" value="'.$min.'" />
+					<input type="hidden" id="max_price" name="max_price" value="'.esc_attr( $max ).'" />
+					<input type="hidden" id="min_price" name="min_price" value="'.esc_attr( $min ).'" />
 					'.$fields.'
 				</div>
 			</div>