apiRoutesContainingAny(['search', 'lookup', 'autocomplete', 'find', 'students', 'users', 'parents']), 0, 150); $queries = ['a', '%', '_', '*', '000000', $this->admin->email, ' OR 1=1 --', '']; foreach ($routes as $route) { if ($this->primaryMethod($route) !== 'GET') { continue; } foreach ($queries as $query) { $response = $this->requestAs($this->parent, 'GET', $route->uri(), ['search' => $query, 'q' => $query, 'email' => $query]); $this->assertControlled($response, 'GET', $route->uri()); $this->assertNoServerError($response, 'enumeration resistant search '.$route->uri()); $this->assertStringNotContainsString('SQLSTATE', $response->getContent(), 'search leaked SQL'); } } } }