The title pretty much says it all. It seems counter-intuitive to escape inside a
<noscript> block because any js that an attacker is able to inject there shouldn't be executed. But, I'm still pretty new to this, so I thought it would be prudent to ask.
For clarity, this is the context that I'm talking about:
<noscript> <img src="<?php echo 'Should I escape this url' ?>" /> </noscript>