Prevent sql injection 

Prevent showing all lists by injecting the '%' character