Prevent sql injection

Prevent showing all lists by injecting the '%' character