diff --git src/bp-members/bp-members-template.php src/bp-members/bp-members-template.php
index 16bb997..9024586 100644
--- src/bp-members/bp-members-template.php
+++ src/bp-members/bp-members-template.php
@@ -457,7 +457,7 @@ function bp_has_members( $args = '' ) {
 	// Pass a filter if ?s= is set.
 	if ( is_null( $search_terms ) ) {
 		if ( !empty( $_REQUEST['s'] ) )
-			$search_terms = $_REQUEST['s'];
+			$search_terms = esc_html( $_REQUEST['s'] );
 		else
 			$search_terms = false;
 	}
diff --git src/bp-templates/bp-legacy/js/buddypress.js src/bp-templates/bp-legacy/js/buddypress.js
index 63eb97f..0327a31 100644
--- src/bp-templates/bp-legacy/js/buddypress.js
+++ src/bp-templates/bp-legacy/js/buddypress.js
@@ -1679,6 +1679,11 @@ function bp_filter_request( object, filter, scope, target, search_terms, page, e
 		search_terms = bp_get_querystring('s');
 	}
 
+	// "JS sanitize" search terms
+	if ( search_terms.length ) {
+		search_terms = escape( search_terms.split( '&' ).join( '&' ) );
+	}
+
 	if ( null === scope ) {
 		scope = 'all';
 	}