Vaccinate search agains SQL injection

fixes #8202