> Personally I’d just consider quoting attribute values to be best practice. And BTW, escaping < and > is not even necessary if you are using quotes with HTML a

> Personally I’d just consider quoting attribute values to be best practice. And BTW, escaping < and > is not even necessary if you are using quotes with HTML attributes, unless you need compatibility with browsers prior to Netscape 2. <a href="...">Label with evil angle brackets</a><script>...