admin can search ongoing sessions within a searching range

for #73359266
Other DB classes have a way to avoid SQL injection. See if that works here too.