Closes #68: Use escapeHTML() instead of sanitize() for attributes.