...but escapeAttribute() here?