Usage of esc_url, esc_html, esc_attr ... functions

Part 1

According to the documentation - Validating, Sanitizing, and Escaping by WP VIP team.

Guiding Principles

1. Never trust user input.
2. Escape as late as possible.
3. Escape everything from untrusted sources (like databases and users), third-parties (like Twitter), etc.
4. Never assume anything.
5. Never trust user input.
6. Sanitation is okay, but validation/rejection is better.
7. Never trust user input.

“Escaping isn’t only about protecting from bad guys. It’s just making our software durable. Against random bad input, against malicious input, or against bad weather.” –nb

Part 2

• Codex entry for esc_html
• Codex entry for esc_attr

According to the article - Introduction to WordPress Front End Security: Escaping the Things by Andy Adams from CSS-Tricks.

Function: esc_html

Used for: Output that should have absolutely no HTML in the output.

What it does: Converts HTML special characters (such as <, >, &) into their "escaped" entity (<, >, &).

Function: esc_attr

Used for: Output being used in the context of an HTML attribute (think "title", "data-" fields, "alt" text).

What it does: The exact same thing as esc_html. The only difference is that different WordPress filters are applied to each function.