fix escaping and security issue

[som3669]

No description provided.

[Copilot]

Pull Request Overview

This PR addresses security vulnerabilities by adding proper escaping to user-controlled content before outputting it to the browser. The changes prevent potential XSS attacks by sanitizing HTML content in various theme template parts.

• Adds HTML escaping to menu fallback output in header template
• Applies HTML escaping to header builder HTML element content
• Uses WordPress's wp_kses_post() function for footer HTML content sanitization

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
template-parts/hooks/header/header.php	Adds esc_html() escaping to menu fallback output and removes coding standards ignore comments
template-parts/header-builder-elements/html-1.php	Applies esc_html() escaping to header HTML element content
template-parts/footer-builder-elements/html-1.php	Uses wp_kses_post() for sanitizing footer HTML content

[Copilot]

Using esc_html() on menu HTML will strip all HTML tags and break the menu structure. The $output variable contains HTML markup (ul/li tags) that should be preserved. Consider using wp_kses() with appropriate allowed tags or ensure the content is already properly escaped when building $output.

Suggested change

	echo esc_html( $output );
	$allowed_html = array(
	'ul' => array(
	'id' => true,
	'class' => true,
	),
	'li' => array(
	'class' => true,
	),
	'a' => array(
	'href' => true,
	'title' => true,
	'class' => true,
	),
	'span' => array(
	'class' => true,
	),
	);
	echo wp_kses( $output, $allowed_html );

[asheshmagar]

@som3669