Escaping untrusted data in php for my wordPress theme
<p>I have got a comment from someone superior to me who wants me to escape some comment in two php snippets which I have posted below. The problem is I don't know how to do that. Can anyone help me by modifying the snippets.</p>

<p>Comment I got:</p>

<p><strong>Comment #1:</strong></p>

<p><strong>Validate and/or sanitize untrusted data before entering into the database. All untrusted data should be escaped before output.</strong></p>

<p><strong>Code Snippet #1:</strong></p>

<pre><code>&lt;?php 
if ( get_header_image() &amp;&amp; !('blank' == get_header_textcolor()) ) { 
        echo '&lt;div class="site-branding header-background-image" style="background-image: url(' . get_header_image() . ')"&gt;'; 
    } else {
        echo '&lt;div class="site-branding"&gt;';
    }
?&gt;
</code></pre>

<p><strong>Code Snippet #2:</strong></p>

<pre><code>&lt;?php
printf(
    /* translators: %1$s = text link: sangeet, URL: http://wordpress.org/themes/sangeet/, %2$s = text link: Kiran Kumar Dash, URL: https://twitter.com/TheKiranDash */
    __( 'Theme: %1$s by %2$s', 'sangeet' ),
                    '&lt;a href="http://wordpress.org/themes/sangeet/" rel="nofollow"&gt;' . esc_attr( 'sangeet', 'sangeet' ) . '&lt;/a&gt;',
    '&lt;a href="https://twitter.com/TheKiranDash" rel="designer nofollow"&gt;' . esc_attr__( 'Kiran Kumar Dash', 'sangeet' ) . '&lt;/a&gt;' ); 

?&gt;
</code></pre>

<p><strong>Comment #2:</strong>
esc all get_permalink() in content.php</p>

<p><strong>Code snippet #3</strong></p>

<pre><code>&lt;?php
if ( !is_single() ) {
    echo '&lt;div class="index-box"&gt;';
    if ( has_post_thumbnail()) {
        echo '&lt;div class="small-index-thumbnail clear"&gt;';
        echo '&lt;a href="' . get_permalink() . '" title="' . __('Read ', 'sangeet') . get_the_title() . '" rel="bookmark"&gt;';
        echo the_post_thumbnail('index-thumb');
        echo '&lt;/a&gt;';
        echo '&lt;/div&gt;';
    }
}
?&gt;
</code></pre>

<p><strong>My approach:</strong></p>

<p>I used esc_url to esc the get_permalink() in the snippet. Shall I use esc_all? Or esc_url is just fine.</p>

<pre><code>&lt;?php
if ( !is_single() ) {
    echo '&lt;div class="index-box"&gt;';
    if ( has_post_thumbnail()) {
        echo '&lt;div class="small-index-thumbnail clear"&gt;';
        echo '&lt;a href="' . esc_url(get_permalink()) . '" title="' . __('Read ', 'sangeet') . get_the_title() . '" rel="bookmark"&gt;';
        echo the_post_thumbnail('index-thumb');
        echo '&lt;/a&gt;';
        echo '&lt;/div&gt;';
    }
}
?&gt;
</code></pre>