I am having trouble understanding how escaping works inside html tag attribute values that are javascript.
I was lead to believe that you should always escape &
' is not a valid HTML reference entity. You should escape using '
'