Don't include separating semicolon in paramter value when sanitizing

Came across this in the wild.

Initial parse fails because of the '?' in the boundary (not a valid character for a parameter unless it's in a quoted string), but then the sanitize method includes the separating semicolon when it turns it into a quoted string.

Fix is to remove any trailing semicolons before double quoting the value.