escape attributes on output