Are the attributes properly escaped ? You may use $this->escapeHtmlAttr($this->attributes);