BUG: sql injection fix for search phrase