Cast string to array (obviuosly), but it has implemented the Wordpress escaping HTML attributes too

Cast String to Array (Wordpress)

<?php
/**
 * Cast string to array. The separator is space ' ' or comma ','.
 * @param $string
 * @return array
 */
function string2array($string) {
    $array = array();

    if( is_string($string) )
        $array = preg_split( '#[\s,]+#', $string );
    
    $array = array_map( 'esc_attr', $array );

    return $array;
}