Prevent sql injection 

Prevent showing all lists by injecting the '%' character
Merge pull request #1 from phoewass/patch-1

Prevent sql injection