Fix XSS in Quotes

Need to escape QuoteFormat before it gets sent to the user.
I'm not sure where $NewFormat is coming from, but it'd be prudent to escape it too.