#109: escape filter attribute/values only in toString()