Escape user input before building regexps

app/controllers/admin/application_forms_controller.rb

@@ -196,7 +196,7 @@ class Admin::ApplicationFormsController < OrbitAdminController
       @application_form_signup_admin_setting = ApplicationFormSignupAdminSetting.create(:application_form_main_id=>"enquiry_for_applicants")
     end
     if params[:name].present?
-      @application_form_signups = ApplicationFormSignup.where(:name => /#{params[:name]}/).sort_ordered.page(params[:page]).per(10)
+      @application_form_signups = ApplicationFormSignup.where(:name => /#{Regexp.escape(params[:name].to_s)}/).sort_ordered.page(params[:page]).per(10)
     else
       @application_form_signups = []
     end
@@ -681,7 +681,7 @@ class Admin::ApplicationFormsController < OrbitAdminController
       if params[:search].to_i != 0
         @application_form_signups = @application_form.application_form_signups.where(:serial_number=>params[:search].to_i)
       else
-        @application_form_signups = @application_form.application_form_signups.where(:name=>/#{params[:search]}/)
+        @application_form_signups = @application_form.application_form_signups.where(:name=>/#{Regexp.escape(params[:search].to_s)}/)
       end
     elsif params[:type] == "session"
       assigned_application_form_signups = @application_form.application_form_sessions.pluck(:application_form_signup_ids,:default_application_form_signup_ids).flatten
@@ -691,7 +691,7 @@ class Admin::ApplicationFormsController < OrbitAdminController
       if @application_form.assign_mode != 0
         unassigned_application_form_signup_ids = @application_form.unassigned_mode_1_application_form_signup_ids
       end
-      @application_form_signups = @application_form.application_form_signups.where(:id.in => unassigned_application_form_signup_ids, :name=>/#{params[:search]}/)
+      @application_form_signups = @application_form.application_form_signups.where(:id.in => unassigned_application_form_signup_ids, :name=>/#{Regexp.escape(params[:search].to_s)}/)
     end
     @application_form_signups = @application_form_signups.order(:id=>-1)
     OrbitHelper.set_params(params,current_user)