Generates a properly escaped HTML string based upon an array of HTML attributes.

esc_attrs.php

<?php

function esc_attrs( $attrs ) {
	$html = ' ';

	$url_attrs = array( 'src', 'href', 'formaction', 'data', 'action', 'icon', 'manifest', 'poster' );

	foreach ( $attrs as $key => $value ) {
		// If an attribute starts with 'on', assume it's a javascript parameter
		if ( 'on' == substr( $key, 0, 2 ) )
			$value = esc_js( $value );
		elseif ( in_array( $key, $url_attrs ) )
			$value = esc_url( $value );
		else
			$value = esc_attr( $value );

		$html .= esc_html( $key ) . "='" . $value . "' ";
	}
	return $html;
}

Interesting. Might be worth a browse through core to see how much use we could make of this.

Needs some strtolower() action on the in_array() and "on" checks. And the key should probably be more strictly sanitized than esc_html().