prevent xss attack on search result