Fix quoting XSS