Fix potential XSS issue with arbitrary JS or HTML

By creating a value for one of the portlet's attributes, such as the data ID, to close out the quoted data attribute, one can inject arbitrary content (JS, HTML, CSS) onto a page.  A value might be:

    '><script>alert('xss')</script><a data-foo='

and the given <script> tag will execute on the resulting page where the Twitter portlet is located.

Escaping the HTML entities for each attribute, and ensuring the attribute is correctly quoted (they are), will prevent this XSS issue.