diff --git a/mod/quiz/export.php b/mod/quiz/export.php
index 4ad463a513c..e6ed588646d 100644
--- a/mod/quiz/export.php
+++ b/mod/quiz/export.php
@@ -33,8 +33,10 @@
 
     if ($form = data_submitted()) {   /// Filename
 
+        $form->format = clean_filename($form->format);
+
         if (! is_readable("format/$form->format/format.php")) {
-            error("Format not known ($form->format)");
+            error('Format not known ('.clean_text($form->format).')');
         }
 
         require("format.php");  // Parent class
diff --git a/mod/quiz/import.php b/mod/quiz/import.php
index 5701cf569ba..393c1763534 100644
--- a/mod/quiz/import.php
+++ b/mod/quiz/import.php
@@ -47,8 +47,10 @@
 
         if (is_array($newfile)) { // either for file already on server or just uploaded file.
 
+            $form->format = clean_filename($form->format);
+
             if (! is_readable("format/$form->format/format.php")) {
-                error("Format not known ($form->format)");
+                error('Format not known ('.clean_text($form->format).')');
             }
 
             require("format.php");  // Parent class