Should I escape the attributes when using get_month_link?

Yes, escaping everything (and as close to output as possible) is a way to go. Right until the point excessive escaping is causing issues in specific circumstances.

Note that while this happens in context of attribute, esc_url() is more fitting for URLs.

Always use esc_url when sanitizing URLs (in text nodes, attribute nodes or anywhere else).

Codex > Data Validation > URLs

Hata!: SQLSTATE[HY000] [1045] Access denied for user 'divattrend_liink'@'localhost' (using password: YES)