Re:Explain SQL injection without technical jargon
by hayksaakian on Friday December 21, 2012 @03:51AM
(#4952022)
Was not trolling. while that's true, I can't imagine a case where you'd want to run queries with JavaScript using unvalidated user input.
My point was that the default with SQL is to write your own queries whereas mongo has an abstraction layer by default.
Re:Explain SQL injection without technical jargon
by saurik on Tuesday December 25, 2012 @03:13AM
(#4965464)
Yet, this has happened before. "NoSQL Doesn’t Mean No SQL Injection"[1] You also need to worry about escaping $ operators in your query documents[2].
[1]: http://www.kalzumeus.com/2010/09/22/security-lessons-learned...
[2]: http://docs.mongodb.org/manual/faq/developers/#dollar-sign-o...
"MongoDB operations permit you to run arbitrary JavaScript expressions directly on the server: $where db.eval() mapReduce group You must exercise care in these cases to prevent users from submitting malicious JavaScript.
Fortunately, you can express most queries in MongoDB without JavaScript and for queries that require JavaScript, you can mix JavaScript and non-JavaScript in a single query."
So while it's certainly easier to avoid this kind of injection, it's certainly not bullet proof.