Fix XSS in Quotes

Need to escape QuoteFormat before it gets sent to the user.
This is still not really what we want as text is still an html format. I recommend just using htmlspecialchars().