Fixed injection in search function