search: prevent HTML/script injection