XSS on Google Search - Sanitizing HTML in The Client?