put the search in the service, and made a querybuilder that can be unit tested. Changed the query to use prepared statements for security reasons.