Lowercase/Uppercase: Encode the query before injecting to HTML.

Can cause XSS badness. CC @moollaza