escape attribute values recursively