I'm not clear how the search_params element is being populated from the UI, but do you think this is a possible point for a sql injection attack?  We might need to clean up the string before using it to build a query, perhaps something like:    
trim($GLOBALS['db']->quote($_REQUEST['search_params']));