Escape this bad boy.  Anytime URLs are inside attributes like this, esc_url() is preferred over esc_attr()