Url-encode search field to prevent XSS