diff --git a/index.js b/index.js
index 6666d32..c5641bf 100644
--- a/index.js
+++ b/index.js
@@ -2,11 +2,14 @@
 const path = require('path');
 
 function escapeAttribute(s = '') {
-  return s.replace(/"/g, '"').replace(/\n/g, '');
+  return s.replace(/&/g, '&')
+          .replace(/</g, '&lt;')
+          .replace(/"/g, '&quot;')
+          .replace(/\n/g, '');
 }
 
 function escapeContent(s = '') {
-  return s.replace(/</g, '&lt;').replace(/&/g, '&amp;');
+  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;');
 }
 
 function treeToXML(tree) {