def encode_html(text, quotes=True):
    """Return text that's safe for an HTML attribute."""
    a = ('&', '&amp;'), ('<', '&lt;'), ('>', '&gt;')
    if quotes:
        a = a + (("'", '&#39;'), ('"', '&quot;'))
    for k, v in a:
        text = text.replace(k, v)
    return text
