server/AyaNova/biz/PickListBiz.cs

@@ -73,16 +73,26 @@ namespace AyaNova.Biz
                 {
                     // split the query on space
                     var querySegments = AutoCompleteQuery.Split(' ');
+                    if (querySegments.Length > 2)
+                    {
+                        AddError(ApiErrorCode.VALIDATION_INVALID_VALUE, "query", "LT:PickListQueryInvalid");
+                        return null;
+                    }
                     // users may type several spaces in a regular query, so ignore that and only use the first two segments
                     if (querySegments[0].Contains(".."))
                     {
                         TagSpecificQuery = querySegments[0].Replace("..", "");
-                        // the second string is considered the 
                         AutoCompleteQuery = querySegments[1];
                     }
+                    else if (querySegments[1].Contains(".."))
+                    {
+                        TagSpecificQuery = querySegments[1].Replace("..", "");
+                        AutoCompleteQuery = querySegments[0];
+                    }
                     else
                     {
-
+                        AddError(ApiErrorCode.VALIDATION_INVALID_VALUE, "query", "LT:PickListQueryInvalid");
+                        return null;
                     }
 
                 }