Code Injection

Is there any way to prevent code injection when using the search function? I was wondering even if any malicious code can be injected to modify the data set. Thanks.