linking to full image (for fancybox) escaping tweaks

I made this change for it to work with fancybox — I believe this is enough for most lightboxes to target; which I would say is enough for “simple” Instagram. It would be best to also let us set a class or id attribute to be applied on the div.si_feed element.

simple-instagram-shortcodes.php, line 61

// this should be done earlier with other attr validation... like $limit = (int) $limit; and $width = (int) width; -- after you strip px and check if it's 'auto'.
if ($wrapper != 'li' || $wrapper != 'div' || $wrapper != 'figure')
  $wrapper = 'div'

$return .= '<' . $wrapper . ' class="si_item">';

$img_element = '<img src="'.esc_url($url).'" '.$w_param.'>';

if($link == 'true'){
   $return .= '<a href="'.esc_url($image->link).'" target="_blank" rel="external nofollow">' . $img_element . '</a>';
}elseif ($link == 'full') {
  $return .= '<a href="'.esc_url($image->images->standard_resolution->url).'" target="_blank" rel="external nofollow">' . $img_element . '</a>';
}else {
  $return .= $img_element;
}

$return .= '</' . $wrapper . '>';

also on line 39 I escaped the width and height attributes

$w_param = 'width="'.esc_attr($width).'" height="'.esc_attr($width).'"';

I’m not using the other shortcodes but I would suggest escaping any other printed values.

Also, Can you give an option for disabling the CSS. I just have it commented out because I merged it with my theme’s, + tweaks.

Thanks

edit — Also, forgot about this one. Make sure to include the shortcode name in shortcode_atts so people can hook into it — ex. so I can enqueue fancybox when the shortcode is in use.
line 13

), $atts, 'si_feed' ) );

http://wordpress.org/plugins/simple-instagram/