diff --git a/app/controllers/cities_autocomplete_controller.rb b/app/controllers/cities_autocomplete_controller.rb
index 2f2f164..faed9a6 100644
--- a/app/controllers/cities_autocomplete_controller.rb
+++ b/app/controllers/cities_autocomplete_controller.rb
@@ -3,8 +3,8 @@ class CitiesAutocompleteController < ApplicationController
 
   def index
     @cities = CSV.read Rails.root.join('db', 'plz_ch.csv')
-
-    @cities = @cities.select { |city| city.first =~ /#{params[:query]}/i || city.last =~ /#{params[:query]}/i  }
+    query = ActionController::Base.helpers.sanitize(params[:query])
+    @cities = @cities.select { |city| city.first =~ /#{query}/i || city.last =~ /#{query}/i  }
     @cities = @cities.map { |city| { plz: city.first, city: city.last } }
 
     render json: @cities.uniq