Also, I don't think this counts as security:
if (strlen($id) == 24) {
// Looks like a valid MongoId
$post = json_decode(file_get_contents('php://input'), true);Checking to see if an ID is of the right length is a good way to filter out miss formated ID's early. And the JSON decoding statement is a pretty standard way to get the JSON body out of the request and into an associative array. Of course you will need to validate that it has the right format now, probably using JSON Schema or something similar.
$m->tampon->queue->insert($post);The API only allows querying posts on the current user (with now user input) so there's no risk of "NoSQL injection": https://github.com/julien-c/Tampon/blob/master/api/posts.php
I use this JSON Schema validator with great success: http://packagist.org/packages/hasbridge/json-schema-validato...