Fix XSS in Quotes

Need to escape QuoteFormat before it gets sent to the user.