No, there isn't a more secure way, especially when you are not outputting input coming from the user. Still, you should be using
Drupal core uses the following code, when outputting an URL.
$requirements ['php'] = array(
'title' => $t('PHP'),
'value' => $phpversion,
'description' => $t('The phpinfo() function has been disabled for security reasons. To see your server\'s phpinfo() information, change your PHP settings or contact your server administrator. For more information, <a href="@phpinfo">Enabling and disabling phpinfo()</a> handbook page.', array('@phpinfo' => 'http://drupal.org/node/243993')),
'severity' => REQUIREMENT_INFO,
$link = l(t('Remove orphaned actions'), 'admin/config/system/actions/orphan');
$count = count($actions_in_db);
$orphans = implode(', ', $orphaned);
watchdog('actions', '@count orphaned actions (%orphans) exist in the actions table. !link', array('@count' => $count, '%orphans' => $orphans, '!link' => $link), WATCHDOG_INFO);
The only difference is that, in the first case, the code is outputting an external URL while, in the other case, the URL is internal to the website.