(SQL Injection) Use ORM in search to handle escaping of query parameters