attribute_escape() in upload form action. Props Nazgul. fixes #4689 f…

…or 2.2.x

git-svn-id: http://svn.automattic.com/wordpress/branches/2.2@5828 1a063a9b-81f0-0310-95a4-ce76da25c4cd

wp-admin/upload-functions.php

@@ -105,8 +105,9 @@ function wp_upload_form() {
 	$id = get_the_ID();
 	global $post_id, $tab, $style;
 	$enctype = $id ? '' : ' enctype="multipart/form-data"';
+	$post_id = (int) $post_id;
 ?>
-	<form<?php echo $enctype; ?> id="upload-file" method="post" action="<?php echo get_option('siteurl') . "/wp-admin/upload.php?style=$style&amp;tab=upload&amp;post_id=$post_id"; ?>">
+	<form<?php echo $enctype; ?> id="upload-file" method="post" action="<?php echo get_option('siteurl') . '/wp-admin/upload.php?style=' . attribute_escape($style) . '&amp;tab=upload&amp;post_id=' . $post_id; ?>">
 <?php
 	if ( $id ) :
 		$attachment = get_post_to_edit( $id );