SECURITY: fix XSS when expanding quotes