(strings/escape html-attribute &<>"')
(strings/escape html-attribute "<b>Tom & 'Sue'</b>")
(strings/escape html-attribute &amp;)
(strings/escape html-attribute "\\$1🙂")
(strings/escape html-attribute "")