Fix XSS vulnerability

The user-supplied values for the attributes are not escaped, which can result in the injection of arbitrary HTML. The attached commit sanitizes them.