closes #6771

public/src/client/search.js

@@ -138,7 +138,7 @@ define('forum/search', ['search', 'autocomplete', 'storage'], function (searchMo
 		if (!searchQuery) {
 			return;
 		}
-
+		searchQuery = utils.escapeHTML(searchQuery);
 		var regexStr = searchQuery.replace(/^"/, '').replace(/"$/, '').trim().split(' ').join('|');
 		var regex = new RegExp('(' + regexStr + ')', 'gi');
 
@@ -151,11 +151,15 @@ define('forum/search', ['search', 'autocomplete', 'storage'], function (searchMo
 				nested.push($('<div />').append($(this)));
 			});
 
-			result.html(result.html().replace(regex, '<strong>$1</strong>'));
+			result.html(result.html().replace(regex, function (match, p1) {
+				return '<strong>' + p1 + '</strong>';
+			}));
 
-			for (var i = 0, ii = nested.length; i < ii; i += 1) {
-				result.html(result.html().replace('<!-- ' + i + ' -->', nested[i].html()));
-			}
+			nested.forEach(function (nestedEl, i) {
+				result.html(result.html().replace('<!-- ' + i + ' -->', function () {
+					return nestedEl.html();
+				}));
+			});
 		});
 
 		$('.search-result-text').find('img:not(.not-responsive)').addClass('img-responsive');

public/src/modules/search.js

@@ -7,24 +7,14 @@ define('search', ['navigator', 'translator', 'storage'], function (nav, translat
 	};
 
 	Search.query = function (data, callback) {
-		var term = data.term;
-
 		// Detect if a tid was specified
-		var topicSearch = term.match(/^in:topic-([\d]+) /);
+		var topicSearch = data.term.match(/^in:topic-([\d]+) /);
 
 		if (!topicSearch) {
-			term = term.replace(/^[ ?#]*/, '');
-
-			try {
-				term = encodeURIComponent(term);
-			} catch (e) {
-				return app.alertError('[[error:invalid-search-term]]');
-			}
-
 			ajaxify.go('search?' + createQueryString(data));
 			callback();
 		} else {
-			var cleanedTerm = term.replace(topicSearch[0], '');
+			var cleanedTerm = data.term.replace(topicSearch[0], '');
 			var tid = topicSearch[1];
 
 			if (cleanedTerm.length > 0) {
@@ -36,8 +26,15 @@ define('search', ['navigator', 'translator', 'storage'], function (nav, translat
 	function createQueryString(data) {
 		var searchIn = data.in || 'titlesposts';
 		var postedBy = data.by || '';
+		var term = data.term.replace(/^[ ?#]*/, '');
+		try {
+			term = encodeURIComponent(term);
+		} catch (e) {
+			return app.alertError('[[error:invalid-search-term]]');
+		}
+
 		var query = {
-			term: data.term,
+			term: term,
 			in: searchIn,
 		};