Prevent SQL Injection on movies search

Validated type and sort params against SORT_TYPES and SEARCH_TYPES for
valid params.