The example in the solution sketch leads me to believe the author is misdirected. URLs have different attack vectors than HTML and have different escaping rules

The example in the solution sketch leads me to believe the author is misdirected. URLs have different attack vectors than HTML and have different escaping rules. In the solution sketch given, the HTML might be safe, but I can easily put any parameters I want into the generated URL. When designing systems like this, each security boundary should be handled separately. Create a URL class that supports escaping fields safely. Create an HTML template engine that supports escaping contents safely. URL.toString will give a guaranteed-safe URL, which can be inserted into a guaranteed-safe attribute later on.