Do substring match for query sanitization