News for hackers. Stuff that matters.

A comment on Explain SQL injection without technical jargon. Parent comment

Re:Explain SQL injection without technical jargon by hayksaakian on Friday December 21, 2012 @03:51AM (#4952022)
Was not trolling. while that's true, I can't imagine a case where you'd want to run queries with JavaScript using unvalidated user input.

My point was that the default with SQL is to write your own queries whereas mongo has an abstraction layer by default.

[ Parent | on HN ]
Re:Explain SQL injection without technical jargon by saurik on Tuesday December 25, 2012 @03:13AM (#4965464)
Yet, this has happened before. "NoSQL Doesn’t Mean No SQL Injection"[1] You also need to worry about escaping $ operators in your query documents[2].

[1]: http://www.kalzumeus.com/2010/09/22/security-lessons-learned...

[2]: http://docs.mongodb.org/manual/faq/developers/#dollar-sign-o...

[ Parent | on HN ]