Improve tokenization and add escaping HTML attributes