no xss for attribute error messages that contain {value}