Answers.Body: <p>You don't need to escape the parameter, that's done by the element query for you. Passing the parameter directly will allow your users to use <a href="https://craftcms.com/docs/4.x/searching.html" rel="nofollow noreferrer">search syntax</a> in the search term, but won't present a security issue.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-11-07T18:53:57.417Z
Answers.Text: Worth noting that the search syntax _can_ allow users to filter by information that is otherwise not public—for example, if a site allowed accountholders to publish (and search by) biographical information… `email:"august domain com"` might make it easier to surmise login info; or `localChapterZipCode:123*` could expose users’ general geographic location. Of course, this is a pretty limited attack surface, as the user would have to know what your fields’ and attributes’ handles are, understand keyword normalization, scoring, etc.
Answers.UserDisplayName: August Miller
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-11-08T09:05:56.303Z
Answers.Text: @AugustMiller Good point! Any best practice to preventing this leak? I.e. is there a way to disallow search syntax when passing user terms?
Answers.UserDisplayName: MoritzLost
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-11-07T08:57:31.103Z
Answers.LastActivityDate: 2023-11-07T08:57:31.103Z
Answers.UserDisplayName: MoritzLost
Body: <p>Extremely not a PHP developer here but trying to set up a simple API with Element API. I've got the basics working to filter my entry results based off of a <code>query</code> URL parameter:</p>
  <pre><code>use craft\elements\Entry;
  
  return [
      'endpoints' =&gt; [
          'recipes.json' =&gt; function() {
              $entryCriteria = [
                  'section' =&gt; 'recipes'
              ];
  
              // filter by search query
              $searchQuery = Craft::$app-&gt;request-&gt;getQueryParam('query');
              if($searchQuery) {
                  $entryCriteria += [
                      'search' =&gt; $searchQuery,
                      'orderBy' =&gt; 'score'
                  ];
              }
  
              return [
                  'elementType' =&gt; Entry::class,
                  'elementsPerPage' =&gt; 12,
                  'criteria' =&gt; $entryCriteria,
                  'transformer' =&gt; function(Entry $entry) {
                      return [
                          'id' =&gt; $entry-&gt;id,
                          'title' =&gt; $entry-&gt;title,
                          'uri' =&gt; $entry-&gt;uri,
                          'recipeImg' =&gt; $entry-&gt;recipeImg-&gt;one()-&gt;url
                      ];
                  },
                  'pretty' =&gt; true
              ];
          }
      ]
  ];
  </code></pre>
  <p>I'm guessing <code>getQueryParam()</code> doesn't escape the returned data by default, and I would assume it's a good idea to do so before passing it into the plugin, but I don't know how to do that. I assume Craft has a built-in function for that but I don't know what it is or how to use it!</p>
  
Tags: <php><plugin-elementapi>
Title: How to Escape a Query Parameter
ThreadText: # How to Escape a Query Parameter
  
  (Asked by: username_0 on 2023-11-06)
  
  Extremely not a PHP developer here but trying to set up a simple API with Element API. I've got the basics working to filter my entry results based off of a `query` URL parameter:
  
  ```
  use craft\elements\Entry;
  
  return [
      'endpoints' => [
          'recipes.json' => function() {
              $entryCriteria = [
                  'section' => 'recipes'
              ];
  
              // filter by search query
              $searchQuery = Craft::$app->request->getQueryParam('query');
              if($searchQuery) {
                  $entryCriteria += [
                      'search' => $searchQuery,
                      'orderBy' => 'score'
                  ];
              }
  
              return [
                  'elementType' => Entry::class,
                  'elementsPerPage' => 12,
                  'criteria' => $entryCriteria,
                  'transformer' => function(Entry $entry) {
                      return [
                          'id' => $entry->id,
                          'title' => $entry->title,
                          'uri' => $entry->uri,
                          'recipeImg' => $entry->recipeImg->one()->url
                      ];
                  },
                  'pretty' => true
              ];
          }
      ]
  ];
  
  ```
  
  I'm guessing `getQueryParam()` doesn't escape the returned data by default, and I would assume it's a good idea to do so before passing it into the plugin, but I don't know how to do that. I assume Craft has a built-in function for that but I don't know what it is or how to use it!
  
  **Tags:** php, plugin-elementapi
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2023-11-07. Score: 3 | Accepted answer
  
  You don't need to escape the parameter, that's done by the element query for you. Passing the parameter directly will allow your users to use [search syntax](https://craftcms.com/docs/4.x/searching.html) in the search term, but won't present a security issue.
  
  > **Comments:**
  > **username_2**: Worth noting that the search syntax _can_ allow users to filter by information that is otherwise not public—for example, if a site allowed accountholders to publish (and search by) biographical information… `email:"username_2 domain com"` might make it easier to surmise login info; or `localChapterZipCode:123*` could expose users’ general geographic location. Of course, this is a pretty limited attack surface, as the user would have to know what your fields’ and attributes’ handles are, understand keyword normalization, scoring, etc.  
  > **username_1**: @username_2 Good point! Any best practice to preventing this leak? I.e. is there a way to disallow search syntax when passing user terms?  
  
  ---
  
  