[Vidya-m78]

Unescaped attribute values in images_as_html output

With images_as_html (or images_with_size when width/height is set), the <img> tag is rebuilt by concatenating src, width, height and alt into single-quoted attributes. HTMLParser has already decoded character references by then, so <img src="x.jpg&#39; onerror=&#39;alert(1)">, which is inert as input and passes an HTML sanitizer that allows img[src], comes out as <img src='x.jpg' onerror='alert(1)' />. Plain values like alt="Bob's photo" also produce broken markup. The values now go through html.escape before being written, and a fixture covers the src/width/alt cases.