Q3 of 22 · Scenarios
How would you test a search box / search functionality?
ScenariosJuniorscenariosearchfunctionalsecurityperformance
Short answer
Short answer: Clarify whether results are full-text or indexed, whether there is autocomplete, and what data sources are searched, then cover result relevance, input edge cases, injection, and performance.
Detail
Clarify first
- Is search full-text or against a structured index (Elasticsearch, DB LIKE query)?
- Are results ranked by relevance, recency, or something else?
- Is there autocomplete or query suggestion?
- Does search span multiple entity types (products, users, articles) or a single type?
Functional
- Query returns relevant results; results match the search term
- Autocomplete suggestions appear after the configured keystroke threshold and are correct
- Clearing the search field returns all results or resets to the default state
- Pagination of results works correctly — page 2 has different results than page 1
- Filters or facets (category, date range) correctly narrow results when combined with search
Negative / error handling
- Empty query or whitespace-only → no results or all results (whichever is specified), no error
- Query with only special characters (/, *, ?,
", etc.) → handled gracefully, no server error - SQL/script injection in search field (
' OR 1=1 --,<script>alert(1)</script>) → treated as literal text, not executed - Very long query string (e.g. 10,000 characters) → truncated or rejected with a clear message
Edge & boundary
- Single-character search (is it supported or is there a minimum length?)
- Exact-match vs partial-match behavior: searching "log" — does "login" appear?
- Case sensitivity: "Login" vs "login" return same results?
- Search while previous results are still loading (race condition — correct results shown)
- Unicode and emoji in the search query
Performance
- Response time for common queries under normal load
- Response time for wildcard or broad queries that return thousands of results
- Behavior under concurrent search requests
Compatibility
- Search works consistently across browsers; mobile keyboard "Search" key submits the query
Close: automate functional result assertions, known injection payloads, and boundary inputs (empty, max length). Keep manual for relevance quality — whether the right results appear at rank 1 is hard to assert programmatically and needs human judgment.
// WHAT INTERVIEWERS LOOK FOR
Injection testing in the search field (a very common vector), result relevance as a manual concern, race conditions from rapid input, and clarifying the search type (full-text vs indexed).
// COMMON PITFALL
Only testing 'search returns results for valid query' and 'no results for nonsense query.' Missing injection, race conditions, and the performance cliff on broad queries.