Is there any other way to create more secure link in a drupal_set_message?
No, there isn't a more secure way, especially when you are not outputting input coming from the user. Still, you should be using t()-placeholders.

Drupal core uses the following code, when outputting an URL.

// system_requirements()
$requirements ['php'] = array(
  'title' =&gt; $t('PHP'),
  'value' =&gt; $phpversion,
  'description' =&gt; $t('The phpinfo() function has been disabled for security reasons. To see your server\'s phpinfo() information, change your PHP settings or contact your server administrator. For more information, &lt;a href="@phpinfo"&gt;Enabling and disabling phpinfo()&lt;/a&gt; handbook page.', array('@phpinfo' =&gt; 'http://drupal.org/node/243993')),
  'severity' =&gt; REQUIREMENT_INFO,
);




  // action_synchronize()
  $link = l(t('Remove orphaned actions'), 'admin/config/system/actions/orphan');
  $count = count($actions_in_db);
  $orphans = implode(', ', $orphaned);
  watchdog('actions', '@count orphaned actions (%orphans) exist in the actions table. !link', array('@count' =&gt; $count, '%orphans' =&gt; $orphans, '!link' =&gt; $link), WATCHDOG_INFO);


The only difference is that, in the first case, the code is outputting an external URL while, in the other case, the URL is internal to the website.