Escape attributes and html.