Escape html special chars in attribute values