You're right, of course and thank you. The apostrophe (as a straight tick) inside your single quoted alt would definitely be a problem.

However, my "incautious phrasing" perhaps led you to this.

I see no indication that OP was allowing customers insert anything inside .html elements, tags or values. (And -- aside -- he's fetching the data from a database, which might suggest the cleanup should occur before the customers are allowed to insert it there)

So, rephrasing:

...a simple tick (in the kind of data context presented by the OP) could, in....

And, again, thank you. That kind of good-catch may save much grief for some future reader presented with my ill-considered words
    ...and I surely hope this is more precise