Since in my workflow I get input from another application to set theURLs and theFilesQuoted I used the Property List Suite which seems to escape all special characters so far.
tell application "System Events"
set PlistFile to "~/Desktop/kMDItemWhereFroms_tmp.plist"
set PlistFirstItem to makenewproperty list itemwith properties {kind:list}
set PlistXML to makenewproperty list filewith properties {name:PlistFile, contents:PlistFirstItem}
makenewproperty list itemat end of every property list item of contents of PlistXMLwith properties {kind:string, value:theURLs}
set PlistBinary to do shell script "plutil -convert binary1 " & PlistFile & " -o - | xxd -p"
do shell script "xattr -w -x com.apple.metadata:kMDItemWhereFroms " & PlistBinary & space & theFilesQuoted
do shell script "mv " & PlistFile & " ~/.Trash/"
end tell