WordPress Security in WordPress - Escaping escape a url
Example
<a href="<?php echo esc_url( home_url( '/' ) ); ?>">Home</a>
<img src="<?php echo esc_url( $user_picture_url ); ?>" />
<a href="<?php echo esc_url( home_url( '/' ) ); ?>">Home</a>
<img src="<?php echo esc_url( $user_picture_url ); ?>" />
