Can't mark HTML attribute values as html_safe

[ajb]

Maybe I'm doing something wrong or reading the spec wrong, but AFAICT, special characters do not have to be HTML-escaped when inside of attribute values.

Here's Erector:

And here's Fortitude:

This came up because we were rendering a <script type='text/template'> element, and were using underscore templates (<%= variable_name >) inside of a href="" attribute.

Also, this might be an issue for data-* attributes where there may be special characters that hook into Javascript plugins?

[ageweke]

You’re absolutely right here — it turns out there are really only two characters you need to escape inside Fortitude’s attribute values, because it double-quotes them all: " and &. I made the changes to make it do this, and added a relevant test case. It should now be a lot easier to use those templates!