fix for sql-injection in documents
sql-injection fixes in dynamic_finder_ajax.php script