3 ms·
... no one is pointing fingers at MySQL, like they are at MongoDB, as if this is some kind of security flaw in MongoDB. It's a feature, not a bug. The docs mak
by optymizer 14y ago
... no one is pointing fingers at MySQL, like they are at MongoDB, as if this is some kind of security flaw in MongoDB.
It's a feature, not a bug. The docs make it clear that $where can run JavaScript, so if you know what you're doing, you're not going to allow JavaScript to flow through your software as if it's valid input.