The html.escape docstring says:

"""
Replace special characters "&", "<" and ">" to HTML-safe sequences.
If the optional flag quote is true (the default), the quotation mark
character (") is also translated.
"""

But if you set the optional flag quote to True, this function also escapes single quotes ('). You can see it by comparing _escape_map and _escape_map_full. [http://hg.python.org/cpython/file/cf811943046b/Lib/html/__init__.py]
The docstring needs to be updated.