injection data shown in history
One of the things I often test, see if a search form shows unfiltered searches.
Search results for: '';<!--"<script>alert(1);</script>
Maybe some filtering should be used? There is no need to repeat such things in the search box