I think anytime we use elgg_echo() in attributes, we should assume it could contain tags/unescaped chars. Using the input/text view would auto-escape the attrs, otherwise something like:
```php
$placeholder = htmlspecialchars(strip_tags(elgg_echo('search')), ENT_QUOTES, 'UTF-8', false);
```