Escape user input before showing in the page.

This is not a security issue since this page is not present in
production and user have to type something in the field but is better to
escape the input.