NaviServer is parent and son of aolserver (aolserver was at some time in the past called NaviServer); of course, both are dependent on Tcl (and link-in Tcl).
NaviServer builds against Tcl 8.6, although i would not recommend it right now for production sites. i am already quite happy that openacs 5.8 can use Tcl 8.5 features to remove some obscure constructs from the past.
Concerning ns_quotehtml: the bug is clearly in some recent aolserver versions; tcl8.6 has the same troubles with C-injected invalid chars.