The point is that if you build a data structure for MongoDB in any language other than PHP, and just include the user parameter where it belongs, the only thing that the user can supply there is a string and it is easy to verify that there is no possible security problem. MongoDB's APIs were designed around this fact as an easy way to avoid the possibility of SQL injection type attacks.

In PHP the exact same approach turned out to be a security hole because if the user supplies the right input you get a data structure that is meaningful to MongoDB.

As you say, you shouldn't assume anything about user generated content. But PHP's willingness to parse that input and turn it into something the programmer didn't expect to see often means that user generated content is harder to deal with in that language than you should reasonably expect it to be.

That's what i'm saying. You shouldn't trust any data from sources like cookies, query strings and even http headers. If you blindly trust them, this is not a problem of programming language. You should sanitize data before using it.