I've never exposed a Postgres or MySQL database directly to the internet, either. They're always listening to localhost connections only, and the only code that

I've never exposed a Postgres or MySQL database directly to the internet, either. They're always listening to localhost connections only, and the only code that gets to make direct calls into them is my code, which means input sanitization prevents attacks like this. The same goes for my use of MongoDB. Though I am curious if anything similar exists for CouchDB, as they seem to be encouraging dangerous configurations like that.