Attributes are not escaped

[sternenseemann]

Consider for example:

(who:htm
  (:input :type "text" :name "title" :value "My cat's birthday"))

; Renders <input type='text' name='title' value='My cat's birthday' />

This would break since ' is not escaped to ' as required by the XML spec. I think for attributes it generally makes sense to always use escape-string-minimal, since I don't see a situation where you'd want to be able to inject arbitrary strings into the tags attribute list.

I guess this can't really be changed now without breaking a lot of existing code depending on who already escaping its attributes, but a setting to change this behavior would be nice.

[stassats]

escape-string-minimal doesn't actually escape #\'