3 ms·
I assume this is trolling, but I'll answer anyways. SQL-injection is about using SQL databases the wrong way. NoSQL injection is about using NoSQL databases the
by eoftedal 14y ago
I assume this is trolling, but I'll answer anyways. SQL-injection is about using SQL databases the wrong way. NoSQL injection is about using NoSQL databases the wrong way. MongoDB had a NoSQL injection in it's PHP driver a while back. It's also prone to SQL-injection as noted in the documentation:
"MongoDB operations permit you to run arbitrary JavaScript expressions directly on the server:
$where
db.eval()
mapReduce
group
You must exercise care in these cases to prevent users from submitting malicious JavaScript.
Fortunately, you can express most queries in MongoDB without JavaScript and for queries that require JavaScript, you can mix JavaScript and non-JavaScript in a single query."
So while it's certainly easier to avoid this kind of injection, it's certainly not bullet proof.
- hayksaakian 14y agoWas not trolling. while that's true, I can't imagine a case where you'd want to run queries with JavaScript using unvalidated user input. My point was that the default with SQL is to write your own queries whereas mongo has an abstraction layer by default.
- saurik 14y agoYet, this has happened before. "NoSQL Doesn’t Mean No SQL Injection"[1] You also need to worry about escaping $ operators in your query documents[2]. [1]: http://www.kalzumeus.com/2010/09/22/security-lessons-learned-from-the-diaspora-launch/ http://www.kalzumeus.com/2010/09/22/security-lessons-learned... [2]: http://docs.mongodb.org/manual/faq/developers/#dollar-sign-operator-escaping http://docs.mongodb.org/manual/faq/developers/#dollar-sign-o...