I've convinced myself attributes don't need xml escaping.