Lowercase/Uppercase: Encode the query before injecting to HTML.

Can cause XSS badness. CC @moollaza 
Sure thing, made an issue for now -- I guess we'll need a new Goodie page