diff --git a/mercurial/hgweb/request.py b/mercurial/hgweb/request.py
--- a/mercurial/hgweb/request.py
+++ b/mercurial/hgweb/request.py
@@ -85,8 +85,10 @@ class wsgirequest(object):
         if type is not None:
             headers.append(('Content-Type', type))
         if filename:
+            filename = (filename.split('/')[-1]
+                        .replace('\\', '\\\\').replace('"', '\\"'))
             headers.append(('Content-Disposition',
-                            'inline; filename=%s' % filename.split('/')[-1]))
+                            'inline; filename="%s"' % filename))
         if length:
             headers.append(('Content-Length', str(length)))
         self.header(headers)
diff --git a/tests/test-webraw b/tests/test-webraw
--- a/tests/test-webraw
+++ b/tests/test-webraw
@@ -3,17 +3,17 @@
 hg init test
 cd test
 mkdir sub
-cat >sub/sometext.txt <<ENDSOME
+cat >'sub/some "text".txt' <<ENDSOME
 This is just some random text
 that will go inside the file and take a few lines.
 It is very boring to read, but computers don't
 care about things like that.
 ENDSOME
-hg add sub/sometext.txt
+hg add 'sub/some "text".txt'
 hg commit -d "1 0" -m "Just some text"
 hg serve -p $HGPORT -A access.log -E error.log -d --pid-file=hg.pid
 cat hg.pid >> $DAEMON_PIDS
-("$TESTDIR/get-with-headers.py" localhost:$HGPORT '/?f=37afcac6d393;file=sub/sometext.txt;style=raw' content-type content-length content-disposition) >getoutput.txt &
+("$TESTDIR/get-with-headers.py" localhost:$HGPORT '/?f=a23bf1310f6e;file=sub/some%20%22text%22.txt;style=raw' content-type content-length content-disposition) >getoutput.txt &
 
 sleep 5
 kill `cat hg.pid`
diff --git a/tests/test-webraw.out b/tests/test-webraw.out
--- a/tests/test-webraw.out
+++ b/tests/test-webraw.out
@@ -1,10 +1,10 @@
 200 Script output follows
 content-type: text/plain
 content-length: 157
-content-disposition: inline; filename=sometext.txt
+content-disposition: inline; filename="some \"text\".txt"
 
 This is just some random text
 that will go inside the file and take a few lines.
 It is very boring to read, but computers don't
 care about things like that.
-host - - [date] "GET /?f=37afcac6d393;file=sub/sometext.txt;style=raw HTTP/1.1" 200 -
+host - - [date] "GET /?f=a23bf1310f6e;file=sub/some%20%22text%22.txt;style=raw HTTP/1.1" 200 -