MDL-62820 question import: properly escape output

mod/lesson/format.php

@@ -726,8 +726,8 @@ class qformat_default {
         // @@PLUGINFILE@@ with a real URL, but it doesn't matter what.
         // We use http://example.com/.
         $text = str_replace('@@PLUGINFILE@@/', 'http://example.com/', $question->questiontext);
-        return html_to_text(format_text($text,
-                $question->questiontextformat, $formatoptions), 0, false);
+        return s(html_to_text(format_text($text,
+                $question->questiontextformat, $formatoptions), 0, false));
     }
 
     /**

question/format.php

@@ -979,8 +979,8 @@ class qformat_default {
      * during import to let the user see roughly what is going on.
      */
     protected function format_question_text($question) {
-        return question_utils::to_plain_text($question->questiontext,
-                $question->questiontextformat);
+        return s(question_utils::to_plain_text($question->questiontext,
+                $question->questiontextformat));
     }
 }