Use escapeHTML from CGI. Or a template system that has the option to escape interpolated variables.
In reply to Re^3: a "search engine" (ahem) by moritz in thread a "search engine" (ahem) by hnd