Escape single quotes

Any HTML escape routines must escape single quotes as these are commonly and validly used to delimit attribute values, and thus can be abused to create an XSS attack.