// PostgREST's .or() filter syntax treats "," "(" and ")" as structural // delimiters between conditions. A raw user-supplied search term containing // them (e.g. from a search box or ?q= param) can break out of the intended // column conditions and append arbitrary extra filters to the query. Strip // them before interpolating — harmless for real name/title searches, which // never legitimately contain them. export function sanitizeIlikeTerm(term: string): string { return term.replace(/[,()]/g, ""); }