I would strongly recommend using -wT in the shebang line (the first line), w turns on warnings, and T does taint checking (as was just mentioned above). This forces you to run your input through a regex that checks for only valid characters (0-9, a-z, A-Z, _, -, etc) and not code that can be executed on your webserver.

I also recommend 'use strict;' to force proper programming technique.

Incorporating your $search in a grep or in your original regex would fix your problem. Right now you're not looking for what was typed, only things with 'jpg' in the title. You can also reduce your regex by using the 'i' operator after the last slash to make your search case-insensitive. I'd suggest you do some searching on google for regexs (you might find a good tutorial here, I haven't looked lately) and how they work.