attr: fix for escaping with HTML