Patched code sample

import sqlite3
import logging

def search_users(search_term):
    # SECURE: Use parameterized queries and input validation
    
    if not isinstance(search_term, str):
        raise ValueError("Search term must be a string")
    
    # Limit search term length
    if len(search_term) > 100:
        raise ValueError("Search term too long")
    
    # Remove potentially dangerous characters
    search_term = search_term.replace('%', '\%').replace('_', '\_')
    
    conn = sqlite3.connect('users.db')
    cursor = conn.cursor()
    
    try:
        # Use parameterized query to prevent SQL injection
        query = "SELECT id, name, email FROM users WHERE name LIKE ? ESCAPE '\\'"
        search_pattern = f"%{search_term}%"
        
        cursor.execute(query, (search_pattern,))
        results = cursor.fetchall()
        
        return results
    except sqlite3.Error as e:
        logging.error(f"Database error: {e}")
        return []
    finally:
        conn.close()

# Example of secure usage:
# users = search_users("john")  # Safe parameterized search
# users = search_users("smith")  # Protected against injection