public static  function escapeAttr($string)
    {
        if ($string !== '' && !ctype_digit($string))
        {
            $matcher = function($matches)
            {
                $chr = $matches[0];
                $ord = ord($chr);

                /**
                 * Replace undefined characters
                 *
                 * Replace characters undefined in HTML with the hex entity for the Unicode
                 * replacement character.
                 */
                if (($ord <= 0x1f && $chr != "\t" && $chr != "\n" && $chr != "\r")
                    || ($ord >= 0x7f && $ord <= 0x9f)
                ) {
                    return '&#xFFFD;';
                }

                /**
                 * Replace name entities
                 *
                 * If the current character to escape has a name entity replace it with while
                 * grabbing the integer value of the character.
                 */
                if (strlen($chr) > 1) {
                    $chr = static::convertEncoding($chr, 'UTF-16BE', 'UTF-8');
                }

                $hex = bin2hex($chr);
                $ord = hexdec($hex);
                if (isset(static::$_entity_map[$ord])) {
                    return '&' . static::$_entity_map[$ord] . ';';
                }

                /**
                 * Per OWASP recommendation
                 *
                 * Use upper hex entities for any other characters where a named entity does
                 * not exist.
                 */
                if ($ord > 255) {
                    return sprintf('&#x%04X;', $ord);
                }

                return sprintf('&#x%02X;', $ord);
            };

            $string = preg_replace_callback('/[^a-z0-9,\.\-_]/iSu', $matcher, $string);
        }

        return $string;
    }