From b7563b8a991fdb4452a38d6a52e8d264189aae6c Mon Sep 17 00:00:00 2001
From: Michael Fields <michael@mfields.org>
Date: Sat, 2 Feb 2013 05:03:08 -1000
Subject: [PATCH] Escape dynamic value $nav_id when used as an attribute and
 html comment. Fixes #146 props @ounziw

---
 inc/template-tags.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/inc/template-tags.php b/inc/template-tags.php
index 04b1215..3ed0a3d 100644
--- a/inc/template-tags.php
+++ b/inc/template-tags.php
@@ -35,7 +35,7 @@ function _s_content_nav( $nav_id ) {
 		$nav_class = 'site-navigation post-navigation';
 
 	?>
-	<nav role="navigation" id="<?php echo $nav_id; ?>" class="<?php echo $nav_class; ?>">
+	<nav role="navigation" id="<?php echo esc_attr( $nav_id ); ?>" class="<?php echo $nav_class; ?>">
 		<h1 class="assistive-text"><?php _e( 'Post navigation', '_s' ); ?></h1>
 
 	<?php if ( is_single() ) : // navigation links for single posts ?>
@@ -55,7 +55,7 @@ function _s_content_nav( $nav_id ) {
 
 	<?php endif; ?>
 
-	</nav><!-- #<?php echo $nav_id; ?> -->
+	</nav><!-- #<?php echo esc_html( $nav_id ); ?> -->
 	<?php
 }
 endif; // _s_content_nav