I know this was here before, but we should basically never directly write html into a string. This should be calling theme_image.
http://api.drupal.org/api/drupal/includes!theme.inc/function/theme_image/7