Use escapeHTML() instead of sanitize() for attributes.

@oyiptong @Mardak anything missing in this one?