Disallow / as it can be used to do XSS.

When / is combined with /script you can do naughty things. Blacklisting
/ is a much safer option.

src/View/Widget/IdGeneratorTrait.php

@@ -48,7 +48,7 @@ protected function _clearIds() {
  */
 	protected function _id($name, $val) {
 		$name = mb_strtolower(Inflector::slug($name, '-'));
-		$idSuffix = mb_strtolower(str_replace(array('@', '<', '>', ' ', '"', '\''), '-', $val));
+		$idSuffix = mb_strtolower(str_replace(array('/', '@', '<', '>', ' ', '"', '\''), '-', $val));
 		$count = 1;
 		$check = $idSuffix;
 		while (in_array($check, $this->_idSuffixes)) {