My comment has no relation to escaping. It's in fact, centered on the idea that any attempt to do so will introduce potential vulnerabilities and the only sane way out of this mess is not having a language in the first place.

Anyway, the idea of blindingly assuming that just because something doesn't use SQL it's invulnerable to any kind of code injection is a very optimistic position.

Thank you for restating my comment. Perhaps your wording will be clearer than mine.

Anyway, NoSQL databases are, by definition, invulnerable to SQL-injection attacks. Perhaps we should start calling them "command injection" or something like it.