Before a *direct quote*, we normally use a comma. It's also correct to use a colon, but it's not very common.

Direct quotes with no punctuation are incorrect.

*Indirect quotes/reported speech* do not require punctuation:

> She whispered that she was cold.