You’re onto the answer…
The function, wp_get_attachment_url() (see Codex) just gives you the URL. You could wrap it in a link:
echo '<tr><td><a href="' . esc_attr(wp_get_attachment_url($row['item_code1'])) . '">' . esc_html($item_1_title) . '</a></td></tr>';
Alternately, you can use wp_get_attachment_link() (see Codex) as you mentioned:
echo wp_get_attachment_link($row['item_code1'], 'medium', false, false, esc_html($item_1_title));
Neither is specifically better all the time, it’ll depend on what you’re doing.
Keep in mind that if you use the first bit of code above, your <a> tag should have an alt attribute. I believe this is for accessibility. You could use the link text, wrapped in esc_attr() for this.
Updated (after added code module)
I’ve looked at your code.
I must be missing something because I don’t see anywhere it’s rendering <a> tags. Going with what you’re saying, that they’re rendered in the front-end HTML, I’d have to guess that someone somewhere has some filter that’s modifying what esc_url() does.
Looking at the core code (line 4171), there’s one filter, clean_url, that’s applied to the output of esc_url() before it returns. It’s messy and poor according to WP best practices, but I’ve seen worse than someone editing that to do something like this. You’d probably have to do a text search on the code base (probably wp-content/plugins, although that could be a lot of code) to find if there’s an instance of this filter being hooked. My spidey sense tells me that this isn’t the place to start though.
Not to be snarky, and I mean this in the most straightforward way, but I’m not completely sure I understand what you’re saying is going wrong. I think you mean that the browser is rendering something like this:
<td>
<a href="http://domain.com/path-to-something">http://domain.com/path-to-something</a>
</td>
That would seem like the right output to me, but you’re asking this question because the output isn’t right to you. This leads me to believe that I don’t fully understand the question, reinforced by the fact that I don’t understand the thing about pasting a URL into a text box.
Could you maybe edit with a snippet of HTML as rendered, and a snippet of HTML as you want it rendered? Given the code you posted, I could try to reconcile the two and see what’s going on.
Updated (let’s try this)
For starters, welcome to WordPress. Also welcome to WP SE.
(Your code doesn’t show in your post with line numbers so please bear with me.)
In the function, get_assigned_codes, try changing this line:
$codes_table .= '<tr><th class="td" scope="col" style="text-align:left;">' . esc_url( wp_get_attachment_url($code_5_title) ) . '</th><td class="td" scope="col" style="text-align:left;">' . esc_html( $row['license_code5'] ) . '</td></tr>';
(it’s the third-to-last line in the function that isn’t whitespace or curlies) with this:
$codes_table .= '<tr><th class="td" scope="col" style="text-align:left;"><a href="' . esc_attr(esc_url(wp_get_attachment_url($code_5_title))) . '">' . esc_url(wp_get_attachment_url($code_5_title)) . '</a></th><td class="td" scope="col" style="text-align:left;">' . esc_html( $row['license_code5'] ) . '</td></tr>';
To see if that works, you’ll have to go to the right place that uses that function and compare the output.
There appear to be a few other places where it’s doing about the same thing (hence why you referenced several code lines) but let’s try one to see what it does.
If you try that, do you get more of what you want?
Updating (a bit more info but we’re onto something)
Try this:
$codes_table .= '<tr><th class="td" scope="col" style="text-align:left;">' . esc_url( wp_get_attachment_url($code_5_title) ) . '</th><td class="td" scope="col" style="text-align:left;"><a href="' . esc_attr( $row['license_code5'] ) . '">' . esc_html($row['license_code5']) . '</a> <a href="' . esc_attr(wp_get_attachment_url($row['license_code5'])) . '">' . esc_html($row['license_code5']) . '</a></td></tr>';
My apologies, the previous suggestion was incorrect. I put the change in the wrong place.
This should print 2 items in the URL field. If either of them is correct, remove the incorrect one and the extra stuff around it. Also, you probably don’t need wp_get_attachment_url() in the left-hand field.