Use newer home_url() function and escape it.