anchor.diff:                 
                   <table>
                     <tr><td>
  -                    <input CLASS="searchbox-input" name="matchText" value="<%=search_string%>" 
  +                    <input CLASS="searchbox-input" name="matchText" value="<%=HTTPUtils.cleanXSS(search_string)%>" 
                              onkeypress="return submitEnter('adv_search',event)" tabindex="1">
                       <h:commandButton id="adv_search" value="Search" action="#{userSessionBean.advancedSearchAction}"
                         onclick="javascript:cursor_wait();"
  
positive.code:                       </td>
                      </tr>
                    <% } else { %>
                      <input type="hidden" name="selectProperty" id="selectProperty" value="<%=selectProperty%>">
                      <input type="hidden" name="rel_search_association" id="rel_search_association" value="<%=rel_search_association%>">
                      <input type="hidden" name="rel_search_rela" id="rel_search_rela" value="<%=rel_search_rela%>">
  
                    <% }%>
  
  
negative.code: 
                </table>
                <input type="hidden" name="referer" id="referer" value="<%=HTTPUtils.getRefererParmEncode(request)%>">
                <input type="hidden" name="dictionary" id="dictionary" value="<%=HTTPUtils.cleanXSS(adv_search_vocabulary)%>">
                <input type="hidden" name="version" id="version" value="<%=HTTPUtils.cleanXSS(adv_search_version)%>">
  
                <input type="hidden" name="adv_search_type" id="adv_search_type" value="<%=HTTPUtils.cleanXSS(adv_search_type)%>" />
  <!--
              </form>
   -->           
  