Escape filename used in Content-Disposition header

Spreadsheet/Excel/Writer.php

@@ -65,6 +65,7 @@ class Spreadsheet_Excel_Writer extends Spreadsheet_Excel_Writer_Workbook
     */
     public function send($filename)
     {
+        $filename = addslashes($filename);
         header("Content-type: application/vnd.ms-excel");
         header("Content-Disposition: attachment; filename=\"$filename\"");
         header("Expires: 0");