def _html_escape_url(attr, safe_mode=False):
 escaped = attr.replace('"', '&quot;').replace('<', '&lt;').replace('>', '&gt;')
 if safe_mode:
  escaped = escaped.replace('+', ' ')
  escaped = escaped.replace("'", '&#39;')
 return escaped

def _html_escape_url ( attr , safe_mode = False ) : escaped = attr . replace ( '"' , '&quot;' ) . replace ( '<' , '&lt;' ) . replace ( '>' , '&gt;' ) if safe_mode : escaped = escaped . replace ( '+' , ' ' ) escaped = escaped . replace ( "'" , '&#39;' ) return escaped
replace special characters that are potentially malicious in url string .