    public function search($q, $page=''){
        $q = str_replace(' ', '+', trim($q));
        if(isset($page) && $page !=''){
            $page = "&page=".$page;
        }else{
            $page = "";
        }
        $url = "http://api.themoviedb.org/3/search/movie?query=".$q."&api_key=".$this->apikey.$page;
        $search = $this->curl($url);
        //echo $search;
        return $search;
    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.