Don't directly inject $_GET parameters in html.

The Search module created a canonical tag containing a directly injected
$_GET parameter. This commit makes sure we encode specialcharacters
making XSS impossible. Fixes #1018