update_page fragments are marked as html_safe even though they have not been html_escaped. When a fragment is passed as an html tag option, the standard html_escape is bypassed because of the html_safe flag. This leaves quotes (") unescaped, causing HTML errors.