Escaping $search and $replace in get_report()

I've been looking through the code in preparation for using this on a project and came across some unescaped usage of $search and $replace in the function get_report(). Most of the UI appears to be using JS to show the report so it's unclear to me the circumstances in which this might be used, but the values should be escaped if they are ever used.