Another XSS bug fix. Must escape " also.