in src/html/element.hack [163:181]
protected final function renderBaseAttrs(): string {
$buf = '<'.$this->tagName;
foreach ($this->getAttributes() as $key => $val) {
if ($val !== null && $val !== false) {
if ($val === true) {
$buf .= ' '.\htmlspecialchars($key);
} else {
if ($val is \Facebook\XHP\UnsafeAttributeValue_DEPRECATED) {
$val_str = $val->toHTMLString();
} else {
$val_str = \htmlspecialchars((string)$val, \ENT_COMPAT);
}
$buf .= ' '.\htmlspecialchars($key).'="'.$val_str.'"';
}
}
}
return $buf;
}