Unescaped variables in attribute values