Escaping attribute values and tag body to prevent HTML injection/XSS attacks