Attribute escaping

src/Icons.php

@@ -33,7 +33,9 @@ function ($final, $current) use ($attributes) {
                         $attribute_value = $attribute_value ? 'true' : 'false';
                     }
 
-                    return $final . $current . '="' . (string)$attribute_value . '" ';
+                    $attribute_value = htmlspecialchars((string)$attribute_value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8', false);
+
+                    return $final . $current . '="' . $attribute_value . '" ';
                 },
                 ''
             );

tests/AttributeTestData.json

@@ -1 +1 @@
-{"name":"feather","attributes":{"stroke-width":1,"color":"red","aria-hidden":true,"class":"classymcclassface"},"xml":"<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1\" stroke-linecap=\"round\" stroke-linejoin=\"round\" class=\"feather feather-feather classymcclassface\" color=\"red\" aria-hidden=\"true\"><path d=\"M20.24 12.24a6 6 0 0 0-8.49-8.49L5 10.5V19h8.5z\"></path><line x1=\"16\" y1=\"8\" x2=\"2\" y2=\"22\"></line><line x1=\"17.5\" y1=\"15\" x2=\"9\" y2=\"15\"></line></svg>"}
+{"name":"feather","attributes":{"stroke-width":1,"color":"red","aria-hidden":true,"class":"classymcclassface","alt":"Test \"quotes\""},"xml":"<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1\" stroke-linecap=\"round\" stroke-linejoin=\"round\" class=\"feather feather-feather classymcclassface\" alt=\"Test &quot;quotes&quot;\" color=\"red\" aria-hidden=\"true\"><path d=\"M20.24 12.24a6 6 0 0 0-8.49-8.49L5 10.5V19h8.5z\"></path><line x1=\"16\" y1=\"8\" x2=\"2\" y2=\"22\"></line><line x1=\"17.5\" y1=\"15\" x2=\"9\" y2=\"15\"></line></svg>"}