better string escaping

replace html attrs
fix bin