fix: attribute values should be escaped