Make sure query strings and filters cannot be used for SQL attacks

[whisperity]

Such as where the run (and product name) filter is accepted from the user.

Also, in these cases with string matching, _ should match the literal, not the SQL syntax char for "single arbitrary character".

[csordasmarton]

"If you have any "special" characters (such as semicolons or apostrophes) in your data, they will be automatically quoted for you by the SQLEngine object, so you don't have to worry about quoting. This also means that unless you deliberately bypass SQLAlchemy's quoting mechanisms, SQL-injection attacks are basically impossible." (Link: http://www.rmunn.com/sqlalchemy-tutorial/tutorial.html)