esc_attr instead of esc_url to preserve spaces in img src #4842