diff --git a/TODO b/TODO
index a82de6d..d16f436 100644
--- a/TODO
+++ b/TODO
@@ -1,5 +1,4 @@
 tmp dir: use pid
-link.cc: outputURL -> outputUnicodes
 remove page from dom -- UI option
 view hash
 update jquery
diff --git a/src/HTMLRenderer/general.cc b/src/HTMLRenderer/general.cc
index 8a4c1a0..871987f 100644
--- a/src/HTMLRenderer/general.cc
+++ b/src/HTMLRenderer/general.cc
@@ -212,7 +212,7 @@ void HTMLRenderer::startPage(int pageNum, GfxState *state, XRef * xref)
                 << "\" data-page-no=\"" << pageNum 
                 << "\" data-page-url=\"";
 
-        outputURL(f_pages.fs, cur_page_filename);
+        outputAttribute(f_pages.fs, cur_page_filename);
         f_pages.fs << "\">";
     }
 
@@ -555,7 +555,7 @@ void HTMLRenderer::embed_file(ostream & out, const string & path, const string &
     else
     {
         out << entry.prefix_external;
-        outputURL(out, fn);
+        outputAttribute(out, fn);
         out << entry.suffix_external << endl;
 
         if(copy)
diff --git a/src/HTMLRenderer/link.cc b/src/HTMLRenderer/link.cc
index 2607b00..a703e7f 100644
--- a/src/HTMLRenderer/link.cc
+++ b/src/HTMLRenderer/link.cc
@@ -195,7 +195,7 @@ void HTMLRenderer::processLink(AnnotLink * al)
     if(!dest_str.empty())
     {
         (*f_curpage) << "<a class=\"" << CSS::LINK_CN << "\" href=\"";
-        outputURL((*f_curpage), dest_str);
+        outputAttribute((*f_curpage), dest_str);
         (*f_curpage) << "\"";
 
         if(!dest_detail_str.empty())
diff --git a/src/HTMLRenderer/outline.cc b/src/HTMLRenderer/outline.cc
index b0cf5b8..354cf59 100644
--- a/src/HTMLRenderer/outline.cc
+++ b/src/HTMLRenderer/outline.cc
@@ -37,7 +37,7 @@ void HTMLRenderer::process_outline_items(GooList * items)
 
         // we don't care dest is empty or not.
         f_outline.fs << "<li>" << "<a class=\"" << CSS::LINK_CN << "\" href=\"";
-        outputURL(f_outline.fs, dest);
+        outputAttribute(f_outline.fs, dest);
         f_outline.fs << "\"";
 
         if(!detail.empty())
diff --git a/src/util/encoding.cc b/src/util/encoding.cc
index 157f3eb..097509c 100644
--- a/src/util/encoding.cc
+++ b/src/util/encoding.cc
@@ -86,6 +86,7 @@ void outputUnicodes(ostream & out, const Unicode * u, int uLen)
     }
 }
 
+/*
 static void outputHEX(ostream & out, char c)
 {
     static const char * hexchars = "0123456789abcdef";
@@ -99,11 +100,11 @@ void outputURL(ostream & out, const string & s)
     {
         dont_escape = new char [256];
         memset(dont_escape, 0, 256 * sizeof(char));
-        /*
+        / *
          * http://tools.ietf.org/html/rfc3986#section-2
          *
          * Also includes '%', in case that the original url has been escaped
-         */
+         * /
         const char * no_escape_chars = ":/?#[]@!$&'()*+,;="
             "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
             "abcdefghijklmnopqrstuvwxyz"
@@ -126,6 +127,7 @@ void outputURL(ostream & out, const string & s)
         }
     }
 }
+*/
 
 void outputJSON(ostream & out, const string & s)
 {
@@ -147,4 +149,35 @@ void outputJSON(ostream & out, const string & s)
     }
 }
 
+void outputAttribute(std::ostream & out, const std::string & s)
+{
+    for (auto iter = s.begin(); iter != s.end(); ++iter)
+    {
+        char c = *iter;
+        switch(c)
+        {
+            case '&':
+                out << "&amp;";
+                break;
+            case '\"':
+                out << "&quot;";
+                break;
+            case '\'':
+                out << "&apos;";
+                break;
+            case '<':
+                out << "&lt;";
+                break;
+            case '>':
+                out << "&gt;";
+                break;
+            case '`': // for IE
+                out << "&#96;";
+                break;
+            default:
+                out << c;
+        }
+    }
+}
+
 } //namespace pdf2htmlEX
diff --git a/src/util/encoding.h b/src/util/encoding.h
index 900e31a..cb84b3b 100644
--- a/src/util/encoding.h
+++ b/src/util/encoding.h
@@ -22,15 +22,20 @@ void outputUnicodes(std::ostream & out, const Unicode * u, int uLen);
 
 
 /*
- * URL encoding
- */
-void outputURL(std::ostream & out, const std::string & s);
-/*
- * JSON encoding
+ * URL escaping
  */
+//void outputURL(std::ostream & out, const std::string & s);
 
+/*
+ * JSON escaping
+ */
 void outputJSON(std::ostream & out, const std::string & s);
 
+/*
+ * HTML tag attribute escaping
+ */
+void outputAttribute(std::ostream & out, const std::string & s);
+
 } // namespace pdf2htmlEX
 
 #endif //ENCODING_H__