diff --git a/static/js/echo.js b/static/js/echo.js
index b5a8a69b89..dbde5af276 100644
--- a/static/js/echo.js
+++ b/static/js/echo.js
@@ -238,6 +238,7 @@ function escape(html, encode) {
     .replace(!encode ? /&(?!#?\w+;)/g : /&/g, '&')
     .replace(/</g, '&lt;')
     .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
     .replace(/'/g, '&#39;');
 }
 
@@ -340,6 +341,11 @@ $(function () {
         return out;
     };
 
+    // Put a newline after a <br> in the generated HTML to match bugdown
+    r.br = function () {
+        return '<br>\n';
+    };
+
     // Disable ordered lists
     // We used GFM + tables, so replace the list start regex for that ruleset
     // We remove the |[\d+]\. that matches the numbering in a numbered list
diff --git a/static/third/marked/lib/marked.js b/static/third/marked/lib/marked.js
index 8e50a0492e..25ba40f85f 100644
--- a/static/third/marked/lib/marked.js
+++ b/static/third/marked/lib/marked.js
@@ -513,7 +513,7 @@ inline.zulip = merge({}, inline.breaks, {
   emoji: /^:([A-Za-z0-9_\-\+]+?):/,
   usermention: /^(@\*\*([^\*]+)?\*\*)/m,
   realm_filters: [],
-  text: replace(inline.text)
+  text: replace(inline.breaks.text)
     (']|', '@:]|')
     ()
 });