Yeah, pretty sure this wasn't tested as this has 3 bugs on 1 line :). It should have `util`, `security` and `encodeForHTMLAttribute` :p