ensure safe quoting; return empty string on nil