Q3 of 22 · Scenarios

How would you test a search box / search functionality?

ScenariosJuniorscenariosearchfunctionalsecurityperformance

Short answer

Short answer: Clarify whether results are full-text or indexed, whether there is autocomplete, and what data sources are searched, then cover result relevance, input edge cases, injection, and performance.

Detail

Clarify first

  • Is search full-text or against a structured index (Elasticsearch, DB LIKE query)?
  • Are results ranked by relevance, recency, or something else?
  • Is there autocomplete or query suggestion?
  • Does search span multiple entity types (products, users, articles) or a single type?

Functional

  • Query returns relevant results; results match the search term
  • Autocomplete suggestions appear after the configured keystroke threshold and are correct
  • Clearing the search field returns all results or resets to the default state
  • Pagination of results works correctly — page 2 has different results than page 1
  • Filters or facets (category, date range) correctly narrow results when combined with search

Negative / error handling

  • Empty query or whitespace-only → no results or all results (whichever is specified), no error
  • Query with only special characters (/, *, ?, ", etc.) → handled gracefully, no server error
  • SQL/script injection in search field (' OR 1=1 --, <script>alert(1)</script>) → treated as literal text, not executed
  • Very long query string (e.g. 10,000 characters) → truncated or rejected with a clear message

Edge & boundary

  • Single-character search (is it supported or is there a minimum length?)
  • Exact-match vs partial-match behavior: searching "log" — does "login" appear?
  • Case sensitivity: "Login" vs "login" return same results?
  • Search while previous results are still loading (race condition — correct results shown)
  • Unicode and emoji in the search query

Performance

  • Response time for common queries under normal load
  • Response time for wildcard or broad queries that return thousands of results
  • Behavior under concurrent search requests

Compatibility

  • Search works consistently across browsers; mobile keyboard "Search" key submits the query

Close: automate functional result assertions, known injection payloads, and boundary inputs (empty, max length). Keep manual for relevance quality — whether the right results appear at rank 1 is hard to assert programmatically and needs human judgment.

// WHAT INTERVIEWERS LOOK FOR

Injection testing in the search field (a very common vector), result relevance as a manual concern, race conditions from rapid input, and clarifying the search type (full-text vs indexed).

// COMMON PITFALL

Only testing 'search returns results for valid query' and 'no results for nonsense query.' Missing injection, race conditions, and the performance cliff on broad queries.