Escape the html attribute correctly

As far as I know, escaping something as in the html context for the html attribute can lead to invalid/insecure html code. Please let me know if I'm wrong.

Note: html_attr escape is available since Twig 1.9.0 (used since symfony v2.1.0 release)