- don't encode apostrophes - only encode quotes in attributes - encode control characters (as in PR #465)