quote injection bugfix