fix possible sql injection in search