Properly escape HTML attribute values