escape quote in attributes