Correct escaping of attribute values