Stricter event searching

will no longer match repos beginning with 'event', now matches 'event_'
escape more things.

I should probably use a general-purpose html escaper here.