lib/PublicInbox/Hval.pm | 35 +++++++++++++++++++++++++++++++++--
 t/hval.t                | 14 ++++++++++++--

diff --git a/lib/PublicInbox/Hval.pm b/lib/PublicInbox/Hval.pm
index 53810b338a0cdc801a558b936e3c7c6f79dd72d2..95a0f7095b59f2a6683b3921f06cfb07b13939f0 100644
--- a/lib/PublicInbox/Hval.pm
+++ b/lib/PublicInbox/Hval.pm
@@ -9,8 +9,8 @@ use warnings;
 use Encode qw(find_encoding);
 use PublicInbox::MID qw/mid_clean mid_escape/;
 use base qw/Exporter/;
-our @EXPORT_OK = qw/ascii_html obfuscate_addrs to_filename src_escape/;
-
+our @EXPORT_OK = qw/ascii_html obfuscate_addrs to_filename src_escape
+		to_attr from_attr/;
 my $enc_ascii = find_encoding('us-ascii');
 
 sub new {
@@ -120,6 +120,37 @@ 	$s =~ tr/././s;
 	$s =~ s/[\.\-]+\z//;
 	$s =~ s/\A[\.\-]+//;
 	$s
+}
+
+# convert a filename (or any string) to HTML attribute
+
+my %ESCAPES = map { chr($_) => sprintf('::%02x', $_) } (0..255);
+$ESCAPES{'/'} = ':'; # common
+
+sub to_attr ($) {
+	my ($str) = @_;
+
+	# git would never do this to us:
+	return if index($str, '//') >= 0;
+
+	my $first = '';
+	if ($str =~ s/\A([^A-Ya-z])//ms) { # start with a letter
+		  $first = sprintf('Z%02x', ord($1));
+	}
+	$str =~ s/([^A-Za-z0-9_\.\-])/$ESCAPES{$1}/egms;
+	$first . $str;
+}
+
+# reverse the result of to_attr
+sub from_attr ($) {
+	my ($str) = @_;
+	my $first = '';
+	if ($str =~ s/\AZ([a-f0-9]{2})//ms) {
+		$first = chr(hex($1));
+	}
+	$str =~ s!::([a-f0-9]{2})!chr(hex($1))!egms;
+	$str =~ tr!:!/!;
+	$first . $str;
 }
 
 1;
diff --git a/t/hval.t b/t/hval.t
index bfc9a856f50ba83886388f34e57ad1f3fa91ddbe..f93d6be6f0bd03df0fc04911348241b4a7fdc358 100644
--- a/t/hval.t
+++ b/t/hval.t
@@ -1,9 +1,9 @@
-# Copyright (C) 2017-2018 all contributors <meta@public-inbox.org>
+# Copyright (C) 2017-2019 all contributors <meta@public-inbox.org>
 # License: AGPL-3.0+ <https://www.gnu.org/licenses/agpl-3.0.txt>
 use strict;
 use warnings;
 use Test::More;
-use_ok 'PublicInbox::Hval';
+use_ok 'PublicInbox::Hval', qw(from_attr to_attr);
 
 my $ibx = {
 	-no_obfuscate_re => qr/(?:example\.com)\z/i,
@@ -46,5 +46,15 @@
 my $s = "\0\x07\n";
 PublicInbox::Hval::src_escape($s);
 is($s, "\\0\\a\n", 'src_escape works as intended');
+
+foreach my $s ('Hello/World.pm', 'Zcat', 'hello world.c', 'Eléanor', '$at') {
+	my $attr = to_attr($s);
+	is(from_attr($attr), $s, "$s => $attr => $s round trips");
+}
+
+{
+	my $bad = to_attr('foo//bar');
+	ok(!$bad, 'double-slash rejected');
+}
 
 done_testing();