XSS possibility displaying search attempts

[benwbrum]

UT reports that searching for <script>alert('foo');</script> will execute the script when displaying search results.