I'm currently getting hundreds of these per second and it keeps bringing down my site.
My best guess is there's a bot putting weird chars in the Search box and AbleCommerce isn't handling the weird characters appropriately.
Any suggestions?

2025-06-27 10:08:55,842 ERROR ADOExceptionReporter Unable to translate Unicode character \uD83D at index 81 to specified code page.
2025-06-27 10:08:55,842 WARN ADOExceptionReporter System.Text.EncoderFallbackException: Unable to translate Unicode character \uD83D at index 81 to specified code page.
at System.Text.EncoderExceptionFallbackBuffer.Fallback(Char charUnknown, Int32 index)
at System.Text.EncoderFallbackBuffer.InternalFallback(Char ch, Char*& chars)
at System.Text.UTF8Encoding.GetBytes(Char* chars, Int32 charCount, Byte* bytes, Int32 byteCount, EncoderNLS baseEncoder)
at System.Text.EncoderNLS.GetBytes(Char[] chars, Int32 charIndex, Int32 charCount, Byte[] bytes, Int32 byteIndex, Boolean flush)
at System.IO.StreamWriter.Flush(Boolean flushStream, Boolean flushEncoder)
at System.IO.StreamWriter.Write(Char[] buffer, Int32 index, Int32 count)
at System.IO.TextWriter.SyncTextWriter.WriteLine(String value)
at NHibernate.AdoNet.Util.SqlStatementLogger.LogCommand(String message, DbCommand command, FormatStyle style)
at NHibernate.AdoNet.AbstractBatcher.ExecuteReader(DbCommand cmd)
at NHibernate.Loader.Loader.GetResultSet(DbCommand st, Boolean autoDiscoverTypes, Boolean callable, RowSelection selection, ISessionImplementor session)
at NHibernate.Loader.Loader.DoQuery(ISessionImplementor session, QueryParameters queryParameters, Boolean returnProxies, IResultTransformer forcedResultTransformer)
at NHibernate.Loader.Loader.DoQueryAndInitializeNonLazyCollections(ISessionImplementor session, QueryParameters queryParameters, Boolean returnProxies, IResultTransformer forcedResultTransformer)
at NHibernate.Loader.Loader.LoadEntity(ISessionImplementor session, Object id, IType identifierType, Object optionalObject, String optionalEntityName, Object optionalIdentifier, IEntityPersister persister)

Does the AC error log show that the error is on the search page? Do IIS logs show posts are coming from one ip or a variety of ip addresses?
You can prevent some errors from being logged by adding code to the global.asax.cs file, like AC does here:
if (((HttpException)exception).Message.StartsWith("A potentially dangerous"))
return;

Yes, I see this sort of thing all the time. The error message is logged, but I assure you that all input forms are coded to prevent an actual SQL injection. We can't stop the attack of course, but it does log the event.

In this case, the bot is trying to insert a character that isn't supported by the database.

I have seen attacks increase exponentially in the last year or so. As a website host, it's very frustrating.