use cgi escape to escape quotes in Tag attributes