Lowercase/Uppercase: Encode the query before injecting to HTML.

Can cause XSS badness. CC @moollaza 
@moollaza Me neither--add to docs?