Escape user input before building regexps

app/controllers/admin/universal_tables_controller.rb

@@ -298,7 +298,7 @@ end
 		keywords = params["q"]
 		keywords = keywords.strip.nil? ? keywords : keywords.strip
 		regexes = keywords.split(/\s+(?=(?:[^"]*"[^"]*")*[^"]*$)/)
-		regex = Regexp.union(regexes.map{|word| Regexp.new(".*"+word+".*", "i")})
+		regex = Regexp.union(regexes.map{|word| Regexp.new(".*"+Regexp.escape(word)+".*", "i")})
 
 		column = table.table_columns.where(:type.in => ["text","editor"])
 		columns = []

app/controllers/universal_tables_controller.rb

@@ -146,7 +146,7 @@ class UniversalTablesController < ApplicationController
 				# 	regexes = v.split(/\s+(?=(?:[^"]*"[^"]*")*[^"]*$)/)
 				# 	regex = Regexp.union(regexes.map{|word| Regexp.new(".*"+word+".*", "i")})
 				# end
-				regex = Regexp.new(".*"+v+".*", "i")
+				regex = Regexp.new(".*"+Regexp.escape(v.to_s)+".*", "i")
 				case column.type
 				when "text"
 					columns = column.column_entries.any_of([{"text.en" => regex}, {"text.zh_tw" => regex}])