The problem is that under the hood there is a query language. When you have no query language, you can't inject commands into it, either by carelessly passing user input down the stack or assembling your own queries.

It would be devilishly hard to inject malicious operations into ZEO/ZODB (the one "NoSQL" I am very familiar with). I can only assume it would be equally hard to do it with systems that do not try to replicate the human-friendly nature of SQL.

See my original comment.

My comment has no relation to escaping. It's in fact, centered on the idea that any attempt to do so will introduce potential vulnerabilities and the only sane way out of this mess is not having a language in the first place.

Anyway, the idea of blindingly assuming that just because something doesn't use SQL it's invulnerable to any kind of code injection is a very optimistic position.

Thank you for restating my comment. Perhaps your wording will be clearer than mine.

Anyway, NoSQL databases are, by definition, invulnerable to SQL-injection attacks. Perhaps we should start calling them "command injection" or something like it.