From f7dba2af72537be6a585df8c4cdace541d544477 Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov@git.wordpress.org>
Date: Fri, 19 Apr 2019 13:50:32 +0000
Subject: [PATCH] Networks and Sites: Use correct escaping function for classes
 added via ` ms_user_list_site_class` filter.

Props david.binda.
Fixes #46990. See #41146.

git-svn-id: https://develop.svn.wordpress.org/trunk@45252 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-admin/includes/class-wp-ms-users-list-table.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wp-admin/includes/class-wp-ms-users-list-table.php b/src/wp-admin/includes/class-wp-ms-users-list-table.php
index cd109e6c83..e3d619ae80 100644
--- a/src/wp-admin/includes/class-wp-ms-users-list-table.php
+++ b/src/wp-admin/includes/class-wp-ms-users-list-table.php
@@ -352,7 +352,7 @@ class WP_MS_Users_List_Table extends WP_List_Table {
 			$site_classes = apply_filters( 'ms_user_list_site_class', $site_classes, $val->userblog_id, $val->site_id, $user );
 			if ( is_array( $site_classes ) && ! empty( $site_classes ) ) {
 				$site_classes = array_map( 'sanitize_html_class', array_unique( $site_classes ) );
-				echo '<span class="' . sanitize_html_class( implode( ' ', $site_classes ) ) . '">';
+				echo '<span class="' . esc_attr( implode( ' ', $site_classes ) ) . '">';
 			} else {
 				echo '<span>';
 			}