Add html escape for query strings