# No-SQL injection

**URL:** <https://discuss.elastic.co/t/no-sql-injection/79403>\
**Category:** Elasticsearch\
**Created:** [March 21, 2017, 11:48am UTC](https://discuss.elastic.co/t/no-sql-injection/79403 "2017-03-21T11:48:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kartik\_Malik](https://avatars.discourse-cdn.com/v4/letter/k/45deac/32.png) [@Kartik\_Malik](https://discuss.elastic.co/u/Kartik_Malik)\
**Post date:** [March 21, 2017, 11:48am UTC](https://discuss.elastic.co/t/no-sql-injection/79403/1 "2017-03-21T11:48:12Z")

</div>

Hi,  
I am very new to elastic search so my question might sound stupid .  
I am working on a project that uses elasticsearch as the database.  
I have a search page on our app, when user enters some **keyword** in the search bar and clicks submit the request is sent to our server, the server code uses the keyword to generates a **GET** request to the Elasticsearch API.  
The data in the database are some articles not anything user specific.

**Now the question I have is, can there be a No-SQL injection attack on our API ?**  
_(As far as i have read, the GET API can only be used to retrieve the data)_  
If there can be a No-SQL injection attack, how to protect it?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 21, 2017, 9:29pm UTC](https://discuss.elastic.co/t/no-sql-injection/79403/2 "2017-03-21T21:29:57Z")

</div>

We've made a number of changes to ES to reduce the possibility of this happening, so it's unlikely.

---

<div class="post-metadata">

**Author:** ![Kartik\_Malik](https://avatars.discourse-cdn.com/v4/letter/k/45deac/32.png) [@Kartik\_Malik](https://discuss.elastic.co/u/Kartik_Malik)\
**Post date:** [March 22, 2017, 3:56am UTC](https://discuss.elastic.co/t/no-sql-injection/79403/3 "2017-03-22T03:56:06Z")

</div>

Thank you 🙂

---

<div class="post-metadata">

**Author:** ![Kartik\_Malik](https://avatars.discourse-cdn.com/v4/letter/k/45deac/32.png) [@Kartik\_Malik](https://discuss.elastic.co/u/Kartik_Malik)\
**Post date:** [March 27, 2017, 6:09am UTC](https://discuss.elastic.co/t/no-sql-injection/79403/4 "2017-03-27T06:09:34Z")

</div>

Hi, I had one more query, from which version of ElasticSearch is this fix impelmented?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2017, 6:10am UTC](https://discuss.elastic.co/t/no-sql-injection/79403/5 "2017-04-24T06:10:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.