escape attribute values properly (#616)