Use escapeHtmlAttr() where appropriate.