keep the <, >, &, ” and ‘ (less than, greater than, ampersand, double quote and single quote) characters.
Example
var_dump('<div>hello</div>'); // hello
var_dump(esc_attr('<div>hello</div>')); // string(<div>hello</div>)
var_dump(esc_attr_e('<div>hello</div>'); // <div>hello</div>