Security fix: Don't display unescaped search fields back to the browser.

There may be other instances of this bug, but I did not spot them (yet)