db_query calls needs to fixed so it doesn't interpret certain characters

Currently the module is throwing the text variable directly into the query.

If you search for variables that contain 'nice' for example the 'n' will be interpreted in the call to db_query.

Not a security issue because this module requires high-level permissions (Administer content types).