Data Sanitization with WordPress' esc_attr()

example-esc-attr.php

<?php
// This is our malicious script
$attr = '"onclick="alert(\'Oops, hacked by XSS!\');';
// This is our escaped, safe attribute
$safe_attr = esc_attr( $attr );
?>
<h1 class="entry-title"><?php _e( 'Testing esc_attr()', 'whit' ); ?></h1>
<p>
    <a href="#" title="<?php echo $attr; ?>">
        <?php _e( 'Example without esc_attr()', 'whit' ); ?>
    </a>
    <br>
    <a href="#" title="<?php echo $safe_attr; ?>">
        <?php _e( 'Example with esc_attr()', 'whit' ); ?>
    </a>
</p>
<form id="test" action="">
    First Name: <input name="firstname" type="text" value="<?php echo $attr; ?>"/>
    <br>
    Last Name: <input name="lastname" type="text" value="<?php echo $safe_attr; ?>"/>
</form>