sql-injection fixes in dynamic_finder_ajax.php script