Deal with handling XSS issues in the query

[yegg]

The query can have XSS bugs in it and so should not be displayed directly. I'm not sure if we currently offer them an escaped version like we have in the backend q_escape. If not we should and it can mimic the backend function.

Also, we need to add to the docs about not returning the query directly in html. For non-HTML we already escape it.

[moollaza]

An explanation about not returning the raw query in the IA's HTML has been added to the docs in this: duckduckgo/duckduckgo-documentation#39

[moollaza]

Moving this issue to the https://github.com/duckduckgo/duckduckgo repo as the fix would need to be implemented there.

[jagtalon]

@moollaza Cool!