escape < and & in attribute values