replace url escaping with attribute escaping