Lowercase/Uppercase: Encode the query before injecting to HTML.

Can cause XSS badness. CC @moollaza 
:+1: 

Might as well use the built-in helper though, `html_enc` so you don't need to `use HTML::Entities`.

More info: https://github.com/duckduckgo/duckduckgo/blob/45c44d14da86e19ccff8c07682722140b17bc020/lib/DDG/Meta/Helper.pm#L40