You CAN do injections to MongoDB code. An injection is basically 'allow user input to interfere with code' so for mongoDB assuming the query is a string you can

You CAN do injections to MongoDB code. An injection is basically 'allow user input to interfere with code' so for mongoDB assuming the query is a string you can do '{name: ' + user_input + '}'. and user_input, without sanitizing it (which is simpler, just converting it to a string) could be: {'$where': ...} http://www.mongodb.org/display/DOCS/Do+I+Have+to+Worry+About+SQL+Injection http://www.mongodb.org/display/DOCS/Do+I+Have+to+Worry+About...