title: HTML and Attribute encoding
body: <p>I came across a <a href="https://meta.stackexchange.com/questions/104230/attack-of-the-double-encoded-hellip-part-n">post on Meta SO</a> and I'm curious about what are the subtle differences between un-encoded and encoded HTML characters, <strong>in HTML attributes</strong>, in contexts of: security, best-practice and browser support.</p>