HTML attributes should be escaped