Use escapeAttr() instead of hand-rolled escapes.