HTML elements' attributes must be escaped even if the values are URLs