fixed XSS vuln in searchbox