Escape user input before building regexps

app/controllers/admin/universal_tables_controller.rb

@@ -298,7 +298,7 @@ end
 		keywords = params["q"]
 		keywords = keywords.strip.nil? ? keywords : keywords.strip
 		regexes = keywords.split(/\s+(?=(?:[^"]*"[^"]*")*[^"]*$)/)
-		regex = Regexp.union(regexes.map{|word| Regexp.new(".*"+word+".*", "i")})
+		regex = Regexp.union(regexes.map{|word| Regexp.new(".*"+Regexp.escape(word)+".*", "i")})
 
 		column = table.table_columns.where(:type.in => ["text","editor"])
 		columns = []