Make sure you escape HTML attributes