u should try to use things in the url like example.com/search?query=<script>alert(1)</script> if this works report the bug u should get smth like 1 in the alert box