Search handles special characters without triggering errors

Unescaped special characters in search queries are a direct path to SQL injection (CWE-89) and OWASP A03:2021 Injection — apostrophes, quotes, and backslashes passed raw into a query string can terminate the intended SQL clause and execute attacker-controlled statements. Beyond active exploitation, the same bug silently breaks legitimate searches: John's Café, Fish & Chips, and Rock (n roll) are common real-world listing names that will surface 500 errors if input validation is absent. Every error response leaks backend implementation details and destroys user trust at the exact moment they're trying to find something.

Switch to parameterized ORM queries and URL-encode the query string on the client. String concatenation into raw SQL is never acceptable here.

// /api/listings/search — use ORM parameterization, never string concat
const results = await db.listings.findMany({
  where: {
    OR: [
      { name: { contains: q, mode: 'insensitive' } },
      { description: { contains: q, mode: 'insensitive' } }
    ]
  }
})

On the client, always encode before appending to the URL: ?q=${encodeURIComponent(query)}. Test with Bob's Diner, Fish & Chips, and <script> to confirm no 500 responses or JS exceptions.