We should standardize on htmlspecialchars and always specify ENT_QUOTES and UTF-8. Using elgg_format_attributes() would probably be cleaner here, at least until we get elgg_format_element.