Change htmlspecialchars to esc_attr(). Props Ryan Satterfield.