Upon further inspection this looks fine. It gets escaped for the data attribute and the javascript is escaping it when it puts it in the DOM so it works.