My gut tells me wrapping the esc_attr() in intval() is redundant when it comes to escaping input, but I would like to double-check. Also: considering that `<option value="">- select no. -</option>` is hardcoded/value is null, that chunk of input wouldn't need to be escaped, correct? Here is my current code set-up: <select name="_number"> <option value="">- select no. -</option> <?php $savedNo = intval( get_post_meta( $post->ID, '_number', true ) ); for ($x = 1; $x <= 100; $x++) { echo '<option value="' . intval(esc_attr($x)) . '"' . ($x === $savedNo ? ' selected="selected"' : '' ) . '>' . 'No. ' . intval(esc_attr($x)) . '</option>'; } ?> </select> Thank you!