Security question: What is the difference between esc_url() and esc_attr() ? In other words, which of the following is best? echo '<a href="' . esc_url($unsafe_url) . '">... echo '<a href="' . esc_attr($unsafe_url) . '">... echo '<a href="' . esc_attr(esc_url$unsafe_url)) . '">... -- http://scribu.net