Prevent attribute injection

app/templates/userpage_post.html

@@ -30,7 +30,7 @@
             :
             <a href='http://youdao.com/w/eng/{{word}}/#keyfrom=dict2.index' title={{word}}>{{word}}</a>
             ({{x[1]}})
-            <input type="checkbox" name="marked" value={{word}}>
+            <input type="checkbox" name="marked" value="{{word}}">
         </p>
 
        {% endfor %}
@@ -42,4 +42,4 @@
         {% endfor %}
     {% endif %}
 </body>
-</html>
+</html>