Here’s a quote

And here’s XSS: "<script>alert(1)</script>