escape an html attribute