Search queries test values

What it breaks

In SQL LIKE a percent sign matches anything, and a parameterised query does not escape it, so PostgreSQL, MySQL and SQLite return every row that merely contains 100, such as 1000 items.

What a correct application does

Only results that contain the text 100%.

What it breaks

In LIKE an underscore matches any single character, so a_b also finds a-b, axb and the a?b of a pasted link, and code that escapes the percent sign often forgets this one.

What a correct application does

Only results that contain a_b.

What it breaks

A wildcard on its own: Elasticsearch query_string returns the whole index, MySQL full-text search and SQLite FTS5 refuse it with a syntax error, and a regular expression built from the query fails with nothing to repeat.

What a correct application does

Results that contain an asterisk, an empty result, or a message, never everything and never an error page.

What it breaks

Elasticsearch query_string, SQLite FTS5 and to_tsquery in PostgreSQL read the quote as the start of a phrase that never ends and stop with a parse error, which an application that passes it on shows as an error page.

What a correct application does

Results for the two words, with the quote ignored or searched as text.

What it breaks

A bracket opens a group that never closes: Elasticsearch query_string, SQLite FTS5, to_tsquery in PostgreSQL, MySQL boolean full-text search and a regular expression built from the query in Python or JavaScript all stop with a syntax error.

What a correct application does

Results for draft, with the bracket ignored or searched as text.

What it breaks

A backslash at the end escapes nothing, so Elasticsearch query_string, SQLite FTS5, to_tsquery in PostgreSQL and a regular expression built from the query in Python or JavaScript stop with a syntax error.

What a correct application does

Results for draft followed by a backslash, an empty result or a message, never an error page.

What it breaks

Tokenisers drop the plus signs, so Elasticsearch and PostgreSQL full-text search return every result with the letter C, SQLite FTS5 and MySQL boolean mode stop with a syntax error, and in a URL built by hand each plus arrives as a space.

What a correct application does

Results about C++ first, not every result with the letter C.

What it breaks

Added to a URL by hand without encoding, the hash sign starts the fragment and the server searches for C. Elasticsearch and PostgreSQL full-text search drop the hash sign too, and MySQL full-text search ignores a word that short.

What a correct application does

Results about C#, with the hash sign reaching the server encoded as %23.

What it breaks

Every word is on the English stop list of PostgreSQL full-text search, so the query becomes empty and the user finds nothing for a famous phrase.

What a correct application does

Results that contain the phrase, or a message that the query was too common.

What it breaks

SQLite FTS5 and Lucene query syntax read upper-case AND as an operator, and full-text search matches the words anywhere, so a record called pepper with sea salt comes up for the phrase the user typed.

What a correct application does

The same results as for salt and pepper, or the phrase searched as typed.

pair 1 of 2 Polish spelling against the same word without accents

What it breaks

Step 1 of the accent test: save a record with this name, the Polish spelling of the city, before searching for it without accents.

What a correct application does

Saved as typed.

pair 2 of 2 Polish spelling against the same word without accents

What it breaks

Step 2: search for the record from step 1 typed without Polish letters, as most users type on a keyboard without them.

What a correct application does

The record from step 1 is found.

What it breaks

Trimmed to an empty query, which some searches answer with every row and others with an error: SQLite FTS5 refuses it, and a URL built by hand loses trailing spaces, so the server receives an empty query.

What a correct application does

An empty result or a message, the same as for an empty search box.

What it breaks

Elasticsearch query_string reads the colon as a field name and the slash as the start of a regular expression and refuses the link, SQLite FTS5 answers no such column, and match queries return every record with example or com.

What a correct application does

Records that contain the link.

What it breaks

Elasticsearch and MySQL full-text search split the address at the at sign and the dots and return every record with example or com, MySQL boolean mode refuses the at sign, and SQLite FTS5 refuses the dot.

What a correct application does

The record with this address first.

What it breaks

Elasticsearch query_string reads a slash as the start of a regular expression and refuses the number, and full-text search in Elasticsearch and MySQL splits it at the slashes and returns every invoice and every other record from 2027.

What a correct application does

The invoice with this number first.

What it breaks

Sent as a GET parameter, the query is longer than web servers accept by default: IIS answers 404 above 2048 bytes, nginx, Apache and Kestrel 414 above about 8 KB, and Node 431 above 16 KB, an error page instead of results or a message.

What a correct application does

Results, or a message that the query is too long.