Hacker News Reader

I'm pretty sure couchdb has a query language which can receive injections. If you pass JavaScript into mongodb theoretically you could open an injection problem if you don't use parametrization. But unless your nosql database has a native API, it still probably is vulnerable to command injection in the same way SQL databases are. Nothing really special about nosql itself that prevents this.

View on HN

Preferred and typical use of MongoDB is with no javascript in the queries. There really is a huge reduction of risk for this one particular attack.

you may be right that i've overgeneralized to the other products based on my experience with mongodb; all i know for sure is mongodb has some nice properties here.

Yes mongo language drivers do make it harder to open up injection problems, but php extension like mysqli also provide similar protection. However the SQL-oriented nature does make it more likely that someone merges uncleaned input into a command.

Reply on news.ycombinator.com