security changes

changed $category_id to be absint in save-data.functions.php. Also changed width and
height to int in save-data.functions.php. Used
esc_url when $return_url is echoed out in API.php.
So a couple issues here.  First, you're using an escaping function where we should be sanitizing.  Second, you're attempting to run `esc_attr()` on an array, which will fail.  

I'd suggest something like `$posted_countries = array_map( 'intval', $_POST['countrylist2'] );`, and then use the `$posted_countries` variable in place of the `$_POST['countrylist2']` variable.