Lowercase/Uppercase: Encode the query before injecting to HTML.

Can cause XSS badness. CC @moollaza 
Whoa! Never knew about that! Thanks @moollaza