Fix the bugs appeared after last PR

Same note about SQL injection here as in the previous PR (https://github.com/xwiki-contrib/application-weeklyactivity/pull/1/files#diff-a11e971d9b3f5b3932a9f8752e8be98eR72). Instead of `like '%" + $input + "%'` use `like :pattern` and then do `$services.query.hql($query).bindValue('pattern', "%$input%").execute()`