Actually, the label is already run through htmlspecialchars() further up, so it would end up as &quot; - not an actual quote.

The CSV output already includes other fields which have HTML-entities, but I could replace these with an escaped quote, if you prefer?