code: def _xml_escape_attr(attr, skip_single_quote=True):
      
      escaped = (attr
          .replace('&', '&amp;')
          .replace('"', '&quot;')
          .replace('<', '&lt;')
          .replace('>', '&gt;'))
      if not skip_single_quote:
          escaped = escaped.replace("'", "&#39;")
      return escaped
docs: Escape the given string for use in an HTML/XML tag attribute.
  
      By default this doesn't bother with escaping `'` to `&#39;`, presuming that
      the tag attribute is surrounded by double quotes.