Error corrections.

Which characters that are immune was random for javascript encoding,
in worst case it threw an exception.
Event handlers like onmouseover shouldn't be allowed to be encoded via
function encodeForHTMLAttribute.
Unsafe html attribute values were not searched for.