Con 1707

Don't we need to escape attributes and values?