diff --git a/tools/spxls/internal/server/protocol.go b/tools/spxls/internal/server/protocol.go
index 6bd604a66..98eaae235 100644
--- a/tools/spxls/internal/server/protocol.go
+++ b/tools/spxls/internal/server/protocol.go
@@ -52,7 +52,7 @@ type SpxResourceURI string
 
 // HTML returns the HTML representation of the spx resource URI.
 func (u SpxResourceURI) HTML() string {
-	return fmt.Sprintf("<resource-preview resource=%q />\n", u)
+	return fmt.Sprintf("<resource-preview resource=%s />\n", attr(string(u)))
 }
 
 // SpxGetDefinitionsParams represents parameters to get definitions at a
diff --git a/tools/spxls/internal/server/spx_definition.go b/tools/spxls/internal/server/spx_definition.go
index 0f53fd2d8..c4ad4ede9 100644
--- a/tools/spxls/internal/server/spx_definition.go
+++ b/tools/spxls/internal/server/spx_definition.go
@@ -27,7 +27,7 @@ type SpxDefinition struct {
 
 // HTML returns the HTML representation of the definition.
 func (def SpxDefinition) HTML() string {
-	return fmt.Sprintf("<definition-item def-id=%q overview=%q>\n%s</definition-item>\n", def.ID, def.Overview, def.Detail)
+	return fmt.Sprintf("<definition-item def-id=%s overview=%s>\n%s</definition-item>\n", attr(def.ID.String()), attr(def.Overview), def.Detail)
 }
 
 // CompletionItem constructs a [CompletionItem] from the definition.
diff --git a/tools/spxls/internal/server/util.go b/tools/spxls/internal/server/util.go
index ed418a075..3a3ee08fb 100644
--- a/tools/spxls/internal/server/util.go
+++ b/tools/spxls/internal/server/util.go
@@ -3,6 +3,7 @@ package server
 import (
 	"fmt"
 	"go/types"
+	"html/template"
 	"io/fs"
 	"regexp"
 	"strings"
@@ -268,3 +269,8 @@ func getSimplifiedTypeString(typ types.Type) string {
 		return p.Name()
 	})
 }
+
+// attr transforms given string value to an HTML attribute value (with quotes).
+func attr(value string) string {
+	return fmt.Sprintf(`"%s"`, template.HTMLEscapeString(value))
+}