esc_attr() all the things.