Without quotes, the payload would escape the actual attribute's value and will start a new attribute with its own payload:
<div class=fist onclick=console.log(document.cookie)>
Whereas with quotes it will remain a harmless single attribute value:
<div class="fist onclick=console.log(document.cookie)">
Note that to prevent XSS you must encode the special characters inside the value as well.
For the SQL injection the situation is different. It is strictly not recommended to declare input values in the query in the first place.
To prevent an SQL injection, a parameter must be defined in the query in place of the actual value, which must be sent to the query execution separately:
$stmt->prepare("SELECT * FROM t WHERE id=?");
Therefore, there must be not a single quote in the query related to the dynamically added value, which makes the question on quotes just irrelevant.