Finally...
I had this problem generating php output, and couldn't find an answer
anywhere.
Escaping into elements was easy with xsl:text, but inside attributes,...
that was a different story.
After looking through other posts, i reached a solution

<!-- fragment of the stylesheet -->
<xsl:output 	method="html" 
			encoding="iso-8859-1"
			omit-xml-declaration="yes"
			use-character-maps="phpTags"
			escape-uri-attributes="no"
			/>

<xsl:character-map name="phpTags">
	<xsl:output-character character="&#60;" string="&#60;"/>
	<xsl:output-character character="&#62;" string="&#62;"/>
</xsl:character-map>


<!-- fragment of the source -->
<form method="post" action="&lt;?=$_POST['name']?&gt;">
	Name: <input type="textbox" value="&lt;?=$_POST['name']?&gt;"
name="name"/><br/>
	Address: <input type="textbox" value="&lt;?=$_POST['add']?&gt;"
name="add"/>
</form>

<!-- generated output -->
<form method="post" action="<?=$_POST['name']?>">
	Name: <input type="textbox" value="<?=$_POST['name']?>"
name="name"><br>
	Address: <input type="textbox" value="<?=$_POST['add']?>"
name="add">
</form>


The escape-uri-attributes seems necessary for the "action" and "href"
attributes, but not for the "value".
I guess "value" is not na uri attribute. :)