esc_url() all the things.
esc_attr() all the things.