This article covers a Bloomreach Experience Manager version 13. There's an updated version available that covers our most recent release.

Sanitize Search Input

HST's SearchInputParsingUtils provide utility methods for sanitizing potentially malicious query strings by filtering out invalid characters or constraining the use of wildcards.

We recommend to always use SearchInputParsingUtils for free-text queries injected into an HstQuery.

For optimal performance, it is best to set the parse method's allowSingleNonLeadingWildCardPerTerm parameter to false:

final HstRequestContext context = request.getRequestContext();
final HippoBean scope = context.getSiteContentBaseBean();

HstQueryBuilder hstQueryBuilder = HstQueryBuilder.create(scope)

// PARSE the query
String query = getPublicRequestParameter(request, "query");
String parsedQuery = SearchInputParsingUtils.parse(query, false);
if (StringUtils.isNotEmpty(parsedQuery)) {
    hstQueryBuilder = hstQueryBuilder.where(constraint(".").contains(parsedQuery));
final HstQuery hstQuery =;

final HstQueryResult result = hstQuery.execute();
request.setAttribute("result", result);
Did you find this page helpful?
How could this documentation serve you better?
On this page
    Did you find this page helpful?
    How could this documentation serve you better?

    We rely on cookies

    to optimize our communication and to enhance your customer experience. By clicking on the Accept and Close button, you agree to the collection of cookies. You can also adjust your preferences by clicking on Manage Preferences. For more information please see our Privacy policy.

    Manage cookies
    Accept & close

    Cookies preferences

    Accept & close