Attributes need to be filtered using forceescape and not tojson, so that double quotes in the attribute string does not create issues.