[fix] just escape attributes, fixes #1