Scrap your code and build it with CGI instead. Attribute arguments are already automatically quoted for you.
Use your existing code in conjunction with the CGI module. At a minimum, you can use &CGI::escapeHTML, though I'm not sure that this is a function meant for public consumption.
Just write some code to do your own escaping. s/"/\\"/g;