Security: fixed SQL injection Friend search