Injection: use single quote for attribute values

This fixes problems with escaping of double quotes.