[MM-18036] Sanitize sql LIKE terms on search endpoints (#12044)

* Sanitize sql LIKE terms on search endpoints

* Add search term sanitization in additional places

store/sqlstore/utils.go

@@ -8,11 +8,27 @@ import (
 	"database/sql"
 	"fmt"
 	"strconv"
+	"strings"
 
 	"github.com/mattermost/gorp"
 	"github.com/mattermost/mattermost-server/mlog"
 )
 
+var escapeLikeSearchChar = []string{
+	"%",
+	"_",
+}
+
+func sanitizeSearchTerm(term string, escapeChar string) string {
+	term = strings.Replace(term, escapeChar, "", -1)
+
+	for _, c := range escapeLikeSearchChar {
+		term = strings.Replace(term, c, escapeChar+c, -1)
+	}
+
+	return term
+}
+
 // Converts a list of strings into a list of query parameters and a named parameter map that can
 // be used as part of a SQL query.
 func MapStringsToQueryParams(list []string, paramPrefix string) (string, map[string]interface{}) {