Ok, I have got it now. The problem is that the double quotes are stored in the db, so when you view the product on the update page the double quotes cause it to break out of the value attribute for that form element and create some new attributes in there.
The fix is to use htmlentities() around the value before it is inserted or updated. This is done in the following locations:
Products Insert line 139
Find the second occurrence of $_POST["ProductName"] and wrap the function around it like this:
htmlentities($_POST["ProductName"])
Products Update line 268
Find the second occurrence of $_POST["ProductName"] and wrap the function around it like this:
htmlentities($_POST["ProductName"])
This should make it so it stores the encoded versions of these characters in the db, but the browser will still display them as quotes. Let me know if you have any other problems with this.
