Controller to list users
Should I moved the foreach loops in the model?


Yes, definitely. 

Currently, you have SQL in the model and the controller, which isn't a good idea. It makes it hard to make out what the actual query will be, and splitting up one functionality (database lookup in this case) in multiple classes is not a good idea in general. SQL should be part of the user model (or DAO), so create a method called searchBy($keywordsArray) there and use that.

Security

You are completely open to SQL injection, as you put $_POST values directly into your query as column name and like clause. When putting variable content into queries, you should always use prepared statements to defend against SQL injection if possible. 

When it's not possible, for example with variable column names, then you should prepare a whitelist of your columns, and check if the user input is in it.