4 ms·
Was not trolling. while that's true, I can't imagine a case where you'd want to run queries with JavaScript using unvalidated user input. My point was that the
by hayksaakian 14y ago
Was not trolling. while that's true, I can't imagine a case where you'd want to run queries with JavaScript using unvalidated user input.
My point was that the default with SQL is to write your own queries whereas mongo has an abstraction layer by default.
- saurik 14y agoYet, this has happened before. "NoSQL Doesn’t Mean No SQL Injection"[1] You also need to worry about escaping $ operators in your query documents[2]. [1]: http://www.kalzumeus.com/2010/09/22/security-lessons-learned-from-the-diaspora-launch/ http://www.kalzumeus.com/2010/09/22/security-lessons-learned... [2]: http://docs.mongodb.org/manual/faq/developers/#dollar-sign-operator-escaping http://docs.mongodb.org/manual/faq/developers/#dollar-sign-o...