Escape user input before building regexps

app/controllers/curation_posts_controller.rb

@@ -39,7 +39,7 @@ class CurationPostsController < ApplicationController
 
     if !params[:category].blank?
       module_id = ModuleApp.where(:key=>"curation").first.id
-      category = Regexp.new(".*"+params[:category]+".*")
+      category = Regexp.new(".*"+Regexp.escape(params[:category].to_s)+".*")
       category_id = Category.where(:title => category, :module_app_id => module_id).first.id
       bulletins = bulletins.where(:category_id => category_id)
     else