See HTML 4.01 section 3.2.2 Attributes:

By default, SGML requires that all attribute values be delimited using either double quotation marks (ASCII decimal 34) or single quotation marks (ASCII decimal 39). Single quote marks can be included within the attribute value when the value is delimited by double quote marks, and vice versa. Authors may also use numeric character references to represent double quotes (") and single quotes ('). For double quotes authors can also use the character entity reference ".

You don't actually need to think about this though, a module such as HTML::Entities will convert strings to use HTML safe characters for you. As a rule of thumb, just run every bit of data through it before stuffing it into your template.