fixing HTML attribute serialization bug #118763 applying a modified

* tree.c: fixing HTML attribute serialization bug #118763
  applying a modified version of the patch from Bacek
* result/HTML/doc3.htm*: this modifies the output from one test
Daniel
diff --git a/tree.c b/tree.c
index ca1a7bb..fc58a5b 100644
--- a/tree.c
+++ b/tree.c
@@ -6607,16 +6607,36 @@
  */
 void
 xmlBufferWriteQuotedString(xmlBufferPtr buf, const xmlChar *string) {
-    if (xmlStrchr(string, '"')) {
-        if (xmlStrchr(string, '\'')) {
+    const xmlChar *cur, *base;
+    if (xmlStrchr(string, '\"')) {
+        if (xmlStrchr(string, '"')) {
 #ifdef DEBUG_BUFFER
 	    xmlGenericError(xmlGenericErrorContext,
  "xmlBufferWriteQuotedString: string contains quote and double-quotes !\n");
 #endif
+	    xmlBufferCCat(buf, "\"");
+            base = cur = string;
+            while(*cur != 0){
+                if(*cur == '"'){
+                    if (base != cur)
+                        xmlBufferAdd(buf, base, cur - base);
+                    xmlBufferAdd(buf, BAD_CAST """, 6);
+                    cur++;
+                    base = cur;
+                }
+                else {
+                    cur++;
+                }
+            }
+            if (base != cur)
+                xmlBufferAdd(buf, base, cur - base);
+	    xmlBufferCCat(buf, "\"");
 	}
-        xmlBufferCCat(buf, "'");
-        xmlBufferCat(buf, string);
-        xmlBufferCCat(buf, "'");
+        else{
+	    xmlBufferCCat(buf, "\'");
+            xmlBufferCat(buf, string);
+	    xmlBufferCCat(buf, "\'");
+        }
     } else {
         xmlBufferCCat(buf, "\"");
         xmlBufferCat(buf, string);