I'm having an issue where the NDC API returns errors when special characters are submitted in the search parameter.

I working on a product that contains a search box that allows the user to lookup medication information. The end users are not restricted right now in what they are allowed to enter into the search box. The information that they enter is surrounded in quotes because I want the users to search for the exact information. All spaces are turned into "+". Finally, any outstanding special characters are converted into their percent codes.

This is the code that we use to form the string

SearchText = Uri.EscapeDataString(SearchText);

if (!(this.SearchText.StartsWith("\"") && (this.SearchText.EndsWith("\""))))
    this.SearchText = "\"" + this.SearchText;
    this.SearchText = this.SearchText + "\"";

SearchText = "generic_name:" + SearchText + "+" + "brand_name:" + SearchText;

return string.Format("?search=({0})+AND+listing_expiration_date:[{1}+TO+9999-12-31]&limit={2}&sort=listing_expiration_date:desc&skip={3}", SearchText, DateTime.Today.ToString("yyyy-MM-dd"), this.PageSize > 0 ? this.PageSize : 100, RecordStart);

When I test with random special characters thrown in, I get error 400 Bad Request responses from the API.

The OpenFDA website doesn't have any information about what characters are allowed in their parameters and I haven't been able to find any standard online. Does anyone know what characters are allowed in the parameters?

  • Hi Matthew, I'm Jack with the openFDA team. I'm looking into compiling a list of allowed characters, but while I'm doing that research, can you post an example query returning a 400 error for you? Thanks!
    – Jack Finch
    Commented Mar 30, 2020 at 16:31

1 Answer 1


I'm Nag with the openFDA team. The following are the supported characters in constructing queries.

Supported characters:

// all letters and numbers
// . for long.field.names
// _ for other_fields
// : for fields
// ( ) for grouping
// " for quoting
// [ ] and { } for ranges
// >, < and = for ranges
// - for dates and boolean
// + for boolean
// space for terms
// @ for internal fields.
var SUPPORTED_QUERY_RE = '^[0-9a-zA-Z@%/\'\,\.\_\:\(\)\"\\[\\]\{\}\\-\\+\>\<\= ]+$';

Please let us know if you're using any other special characters in the query. can you post an example query returning a 400 error for you?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.