Escape output for an HTML attribute in PHP

// ENT_QUOTES is the argument that matters: the default leaves ' untouched
$title = htmlspecialchars($product->name, ENT_QUOTES, 'UTF-8');

echo '<a href="/product/' . rawurlencode($product->slug) . '" title="' . $title . '">';