XSS issue : now sanitize search query input