Use `$db->escape_string_like()` where possible

Although this doesn't pose any security risk, it can affect user experience when searching for underscores or percent symbols.