Fix #2075131 [Private bug](https://bugs.launchpad.net/calibre/+bug/20…

…75131)

src/calibre/db/backend.py

@@ -2365,18 +2365,20 @@ def search_annotations(self,
         fts_engine_query = unicode_normalize(fts_engine_query)
         fts_table = 'annotations_fts_stemmed' if use_stemming else 'annotations_fts'
         text = 'annotations.searchable_text'
+        data = []
         if highlight_start is not None and highlight_end is not None:
             if snippet_size is not None:
-                text = "snippet({fts_table}, 0, '{highlight_start}', '{highlight_end}', '…', {snippet_size})".format(
-                        fts_table=fts_table, highlight_start=highlight_start, highlight_end=highlight_end,
-                        snippet_size=max(1, min(snippet_size, 64)))
+                text = "snippet({fts_table}, 0, ?, ?, '…', {snippet_size})".format(
+                        fts_table=fts_table, snippet_size=max(1, min(snippet_size, 64)))
             else:
-                text = f"highlight({fts_table}, 0, '{highlight_start}', '{highlight_end}')"
+                text = f"highlight({fts_table}, 0, ?, ?)"
+            data.append(highlight_start)
+            data.append(highlight_end)
         query = 'SELECT {0}.id, {0}.book, {0}.format, {0}.user_type, {0}.user, {0}.annot_data, {1} FROM {0} '
         query = query.format('annotations', text)
         query += ' JOIN {fts_table} ON annotations.id = {fts_table}.rowid'.format(fts_table=fts_table)
         query += f' WHERE {fts_table} MATCH ?'
-        data = [fts_engine_query]
+        data.append(fts_engine_query)
         if restrict_to_user:
             query += ' AND annotations.user_type = ? AND annotations.user = ?'
             data += list(restrict_to_user)

src/calibre/db/fts/connect.py

@@ -156,20 +156,22 @@ def search(self,
             return
         fts_engine_query = unicode_normalize(fts_engine_query)
         fts_table = 'books_fts' + ('_stemmed' if use_stemming else '')
+        data = []
         if return_text:
             text = 'books_text.searchable_text'
             if highlight_start is not None and highlight_end is not None:
                 if snippet_size is not None:
-                    text = f'''snippet("{fts_table}", 0, '{highlight_start}', '{highlight_end}', '…', {max(1, min(snippet_size, 64))})'''
+                    text = f'''snippet("{fts_table}", 0, ?, ?, '…', {max(1, min(snippet_size, 64))})'''
                 else:
-                    text = f'''highlight("{fts_table}", 0, '{highlight_start}', '{highlight_end}')'''
+                    text = f'''highlight("{fts_table}", 0, ?, ?)'''
+                data.append(highlight_start)
+                data.append(highlight_end)
             text = ', ' + text
         else:
             text = ''
         query = 'SELECT {0}.id, {0}.book, {0}.format {1} FROM {0} '.format('books_text', text)
         query += f' JOIN {fts_table} ON fts_db.books_text.id = {fts_table}.rowid'
         query += ' WHERE '
-        data = []
         conn = self.get_connection()
         temp_table_name = ''
         if restrict_to_book_ids:

src/calibre/db/notes/connect.py

@@ -413,13 +413,15 @@ def search(self,
             return
         fts_engine_query = unicode_normalize(fts_engine_query)
         fts_table = 'notes_fts' + ('_stemmed' if use_stemming else '')
+        hl_data = ()
         if return_text:
             text = 'notes.searchable_text'
             if highlight_start is not None and highlight_end is not None:
                 if snippet_size is not None:
-                    text = f'''snippet("{fts_table}", 0, '{highlight_start}', '{highlight_end}', '…', {max(1, min(snippet_size, 64))})'''
+                    text = f'''snippet("{fts_table}", 0, ?, ?, '…', {max(1, min(snippet_size, 64))})'''
                 else:
-                    text = f'''highlight("{fts_table}", 0, '{highlight_start}', '{highlight_end}')'''
+                    text = f'''highlight("{fts_table}", 0, ?, ?)'''
+                hl_data = (highlight_start, highlight_end)
             text = ', ' + text
         else:
             text = ''
@@ -433,7 +435,7 @@ def search(self,
         if limit is not None:
             query += f' LIMIT {limit}'
         try:
-            for record in conn.execute(query, restrict_to_fields+(fts_engine_query,)):
+            for record in conn.execute(query, hl_data + restrict_to_fields + (fts_engine_query,)):
                 result = {
                     'id': record[0],
                     'field': record[1],