just to be sure, is $atts['title'] correctly escaped before output?