showPathAndSearch(): put HTML escaping right