This code uses SQL's concatenate operator to allow us to pass in q as a parameter to the query, this protects us from SQL injection attacks, letting the ORM code take care of any escaping that needs to be done