diff --git a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java
index 60c207009..d03b2f460 100644
--- a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java
+++ b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java
@@ -30,7 +30,7 @@ public class SQLInjectionValidator {
 
 	private final static String[] COMMENTS = { "--", "({", "/*", "#" };
 
-	private final static String SQL_PATTERN = "[a-zA-Z_=,\\-'!><.?\"`% ()0-9]*";
+	private final static String SQL_PATTERN = "[a-zA-Z_=,\\-'!><.?\"`% ()0-9*\n\r]*";
 
 	public final static void validateSQLInput(final String sqlSearch) {
 		String lowerCaseSQL = sqlSearch.toLowerCase();
@@ -115,9 +115,9 @@ public class SQLInjectionValidator {
 		}
 	}
 	public final static void validateAdhocQuery(final String sqlSearch) {
-		String lowerCaseSQL = sqlSearch.toLowerCase();
+		String lowerCaseSQL = sqlSearch.toLowerCase().trim();
 		for (String ddl : DDL_COMMANDS) {
-			if (lowerCaseSQL.contains(ddl)) {
+			if (lowerCaseSQL.startsWith(ddl)) {
 				throw new SQLInjectionException();
 			}
 		}