Fix sql injection bug and small issue with search