HTML escape attribute values and names

Attribute values should be HTML escaped when written into an HTML page, to avoid problems with quotation marks or other special characters.

This patch also escapes attribute names for safety, although such cases should not arise.