code: public static String escapeAttributeValue(Object content)
      {
          if (content == null) {
              return null;
          }
          String str = String.valueOf(content);
          StringBuilder result = new StringBuilder((int) (str.length() * 1.1));
          int length = str.length();
          char c;
          for (int i = 0; i < length; ++i) {
              c = str.charAt(i);
              switch (c) {
                  case '&':
                      result.append(AMP);
                      break;
                  case '\'':
                      result.append(APOS);
                      break;
                  case '"':
                      result.append(QUOT);
                      break;
                  case '<':
                      result.append(LT);
                      break;
                  case '>':
                      result.append(GT);
                      break;
                  case '{':
                      result.append(LCURL);
                      break;
                  default:
                      result.append(c);
              }
          }
          return result.toString();
      }
docs: Escapes all the XML special characters and left curly bracket in a <code>String</code> using numerical XML
  entities, so that the resulting string can safely be used as an XML attribute value. Specifically, escapes &lt;,
  &gt;, ", ', &amp; and {.  Left curly bracket is included here to protect against {{/html}} in xwiki 2.x syntax.
  
  @param content the text to escape, may be {@code null}
  @return a new escaped {@code String}, {@code null} if {@code null} input