diff --git a/.changeset/wicked-socks-share.md b/.changeset/wicked-socks-share.md
new file mode 100644
index 0000000000..d3e1275732
--- /dev/null
+++ b/.changeset/wicked-socks-share.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-search-backend': patch
+---
+
+Error messages should not contain backend SQL query strings in the API response, this change will ensure that messages are logged and empty response is returned to the user
diff --git a/plugins/search-backend/src/service/router.ts b/plugins/search-backend/src/service/router.ts
index 0ba5eede81..51d32e9e95 100644
--- a/plugins/search-backend/src/service/router.ts
+++ b/plugins/search-backend/src/service/router.ts
@@ -201,6 +201,17 @@ export async function createRouter(
         // re-throw and let the default error handler middleware captures it and serializes it with the right response code on the standard form
         throw error;
       }
+      if (query.term.indexOf('<') !== -1) {
+        // Search queries that contain '<' are likely to be a SQL injection attack, log the error and return an empty response
+        const message = (error as any)?.message || '';
+        if (
+          typeof message === 'string' &&
+          message.indexOf('syntax error in tsquery') !== -1
+        ) {
+          logger.info('Search query skipped due to tsquery syntax error.');
+          return; // Do not throw an error and just skip the search
+        }
+      }
 
       throw new Error(
         `There was a problem performing the search query: ${error.message}`,