search to sql: use str_getcsv instead of explode to support quoted long string tokens