parameterized query

Sending the SQL command and the user's input to the database separately, so the input can only ever be data. It is the fix for the shop's search page.