refs #4126 escape html attributes