Add = ? in coder searches controller to prevent SQL injection.