attribute-value escaping might be excessive in some cases, but better
safe than sorry

h/t @cdent for suggesting to look to Python as a reference