Add url escaping to constants

Since these constants can be defined by the user (in wp-config.php or
elsewhere), their value cannot be completely trusted, so escaping them
is necessary.