<p>You don't need to escape the parameter, that's done by the element query for you. Passing the parameter directly will allow your users to use <a href="https://craftcms.com/docs/4.x/searching.html" rel="nofollow noreferrer">search syntax</a> in the search term, but won't present a security issue.</p>

CC BY-SA 4.0
2023-11-07T18:53:57.417Z
Worth noting that the search syntax _can_ allow users to filter by information that is otherwise not public—for example, if a site allowed accountholders to publish (and search by) biographical information… `email:"august domain com"` might make it easier to surmise login info; or `localChapterZipCode:123*` could expose users’ general geographic location. Of course, this is a pretty limited attack surface, as the user would have to know what your fields’ and attributes’ handles are, understand keyword normalization, scoring, etc.
August Miller
CC BY-SA 4.0
2023-11-08T09:05:56.303Z
@AugustMiller Good point! Any best practice to preventing this leak? I.e. is there a way to disallow search syntax when passing user terms?
MoritzLost
CC BY-SA 4.0
2023-11-07T08:57:31.103Z
2023-11-07T08:57:31.103Z
MoritzLost
<p>Extremely not a PHP developer here but trying to set up a simple API with Element API. I've got the basics working to filter my entry results based off of a <code>query</code> URL parameter:</p>
<pre><code>use craft\elements\Entry;

return [
    'endpoints' =&gt; [
        'recipes.json' =&gt; function() {
            $entryCriteria = [
                'section' =&gt; 'recipes'
            ];

            // filter by search query
            $searchQuery = Craft::$app-&gt;request-&gt;getQueryParam('query');
            if($searchQuery) {
                $entryCriteria += [
                    'search' =&gt; $searchQuery,
                    'orderBy' =&gt; 'score'
                ];
            }

            return [
                'elementType' =&gt; Entry::class,
                'elementsPerPage' =&gt; 12,
                'criteria' =&gt; $entryCriteria,
                'transformer' =&gt; function(Entry $entry) {
                    return [
                        'id' =&gt; $entry-&gt;id,
                        'title' =&gt; $entry-&gt;title,
                        'uri' =&gt; $entry-&gt;uri,
                        'recipeImg' =&gt; $entry-&gt;recipeImg-&gt;one()-&gt;url
                    ];
                },
                'pretty' =&gt; true
            ];
        }
    ]
];
</code></pre>
<p>I'm guessing <code>getQueryParam()</code> doesn't escape the returned data by default, and I would assume it's a good idea to do so before passing it into the plugin, but I don't know how to do that. I assume Craft has a built-in function for that but I don't know what it is or how to use it!</p>

<php><plugin-elementapi>
How to Escape a Query Parameter
# How to Escape a Query Parameter

(Asked by: username_0 on 2023-11-06)

Extremely not a PHP developer here but trying to set up a simple API with Element API. I've got the basics working to filter my entry results based off of a query URL parameter:
use craft\elements\Entry;

return [
    'endpoints' => [
        'recipes.json' => function() {
            $entryCriteria = [
                'section' => 'recipes'
            ];

            // filter by search query
            $searchQuery = Craft::$app->request->getQueryParam('query');
            if($searchQuery) {
                $entryCriteria += [
                    'search' => $searchQuery,
                    'orderBy' => 'score'
                ];
            }

            return [
                'elementType' => Entry::class,
                'elementsPerPage' => 12,
                'criteria' => $entryCriteria,
                'transformer' => function(Entry $entry) {
                    return [
                        'id' => $entry->id,
                        'title' => $entry->title,
                        'uri' => $entry->uri,
                        'recipeImg' => $entry->recipeImg->one()->url
                    ];
                },
                'pretty' => true
            ];
        }
    ]
];

I'm guessing getQueryParam() doesn't escape the returned data by default, and I would assume it's a good idea to do so before passing it into the plugin, but I don't know how to do that. I assume Craft has a built-in function for that but I don't know what it is or how to use it!

**Tags:** php, plugin-elementapi

---

## 1 answers

### Answer by username_1 on 2023-11-07. Score: 3 | Accepted answer

You don't need to escape the parameter, that's done by the element query for you. Passing the parameter directly will allow your users to use [search syntax](https://craftcms.com/docs/4.x/searching.html) in the search term, but won't present a security issue.

> **Comments:**
> **username_2**: Worth noting that the search syntax _can_ allow users to filter by information that is otherwise not public—for example, if a site allowed accountholders to publish (and search by) biographical information… `email:"august domain com"` might make it easier to surmise login info; or `localChapterZipCode:123*` could expose users’ general geographic location. Of course, this is a pretty limited attack surface, as the user would have to know what your fields’ and attributes’ handles are, understand keyword normalization, scoring, etc.  
> **username_1**: @AugustMiller Good point! Any best practice to preventing this leak? I.e. is there a way to disallow search syntax when passing user terms?  

---

