Security fix: Don't display unescaped search fields back to the browser.