Like block: Escape attributes in the block output (#34536)

* Escape HTML attributes in the Like block output

* Add changelog file

Author: ivan-ottinger

projects/plugins/jetpack/changelog/add-like-block-attributes-escape

@@ -0,0 +1,4 @@
+Significance: patch
+Type: other
+
+Like block (beta): Escape block output attributes

projects/plugins/jetpack/extensions/blocks/like/like.php

@@ -89,11 +89,11 @@ function render_block( $attr, $content, $block ) {
 	$name    = sprintf( 'like-post-frame-%1$d-%2$d-%3$s', $blog_id, $post_id, $uniqid );
 	$wrapper = sprintf( 'like-post-wrapper-%1$d-%2$d-%3$s', $blog_id, $post_id, $uniqid );
 
-	$html  = "<div class='sharedaddy sd-block sd-like jetpack-likes-widget-wrapper jetpack-likes-widget-unloaded' id='$wrapper' data-src='$src' data-name='$name' data-title='$title'>";
-	$html .= $headline;
-	$html .= "<div class='likes-widget-placeholder post-likes-widget-placeholder' style='height: 55px;'><span class='button'><span>" . esc_html__( 'Like', 'jetpack' ) . '</span></span> <span class="loading">' . esc_html__( 'Loading...', 'jetpack' ) . '</span></div>';
-	$html .= "<span class='sd-text-color'></span><a class='sd-link-color'></a>";
-	$html .= '</div>';
+	$html = "<div class='sharedaddy sd-block sd-like jetpack-likes-widget-wrapper jetpack-likes-widget-unloaded' id='" . esc_attr( $wrapper ) . "' data-src='" . esc_attr( $src ) . "' data-name='" . esc_attr( $name ) . "' data-title='" . esc_attr( $title ) . "'>"
+		. $headline
+		. "<div class='likes-widget-placeholder post-likes-widget-placeholder' style='height: 55px;'><span class='button'><span>" . esc_html__( 'Like', 'jetpack' ) . "</span></span> <span class='loading'>" . esc_html__( 'Loading...', 'jetpack' ) . '</span></div>'
+		. "<span class='sd-text-color'></span><a class='sd-link-color'></a>"
+		. '</div>';
 
 	return sprintf(
 		'<div class="%1$s">%2$s</div>',