fixed XSS vuln in search box