Properly escape tags while building query

Could it really be that easy?