A well crafted HTML attribute had the potential to evade sanitization due to incorrect escaping of the attribute whilst serializing it.

This version resolves that issue. In doing so it will also correctly use & to separate query string values in URLs within HTML attributes (href, src, ...).