fix: escape a single quote

[yusukebe]

Hi,

Firstly, thank you for the great project.

In this PR, I've implemented the escaping of a single quote (0x27) to '. This modification will prevent the potential execution of scripts, as illustrated below:

const value = "alert('bar!')";
return <div onMouseOver={value}>foo</div>;