Explain why you shouldn't return the unescaped query as HTML in Goodies

[moollaza]

When creating a Goodie, the original query should not be directly returned as html as this creates the possibility for XSS to occur.

Returning the original query in the plain-text Goodie output is alright though as we already escape it.

I suggest this be added to the FAQ and should also be mentioned in the Goodie tutorial.

This issue was originally mentioned in duckduckgo/zeroclickinfo-goodies#223