title: escaping inside html tag attribute value
body: <p>I am having trouble understanding how escaping works inside html tag attribute values that are javascript.</p>
  
  <p>I was lead to believe that you should always escape &amp; ' " &lt; > . So for javascript as an attribute value I tried:</p>
  
  <pre><code>&lt;a href="javascript:alert(&amp;apos;Hello&amp;apos;);"&gt;&lt;/a&gt;
  </code></pre>
  
  <p>It doesn't work. However:</p>
  
  <pre><code>&lt;a href="javascript:alert(&amp;#39;Hello&amp;#39;);"&gt;&lt;/a&gt;
  </code></pre>
  
  <p>and </p>
  
  <pre><code>&lt;a href="javascript:alert('Hello');"&gt;&lt;/a&gt;
  </code></pre>
  
  <p>does work in all browsers!</p>
  
  <p>Now I am totally confused. If all my attribute values are enclosed in double quotes, does this mean I do not have to escape single quotes? Or is apos and ascii 39 technically different characters? Such that javascript requires ascii 39, but not apos?</p>