fixing up sql inj hole in search. duh....