We lost the escaping here. Was that intentional? Do we know that get_url() returns a safe value?