added esc_attr() calls