Escape double quotes in addition to angle brackets and ampersands.

diff --git a/tornado/escape.py b/tornado/escape.py
index 8773bf9c38519d57b638155ad5e32a1bc8d8cac8..bacb1c51d004dd7aa13361a5abb0b552f4da6669 100644 (file)
--- a/tornado/escape.py
+++ b/tornado/escape.py
@@ -44,7 +44,7 @@ except:
 
 def xhtml_escape(value):
     """Escapes a string so it is valid within XML or XHTML."""
-    return utf8(xml.sax.saxutils.escape(value))
+    return utf8(xml.sax.saxutils.escape(value, {'"': """}))
 
 
 def xhtml_unescape(value):