Was not trolling. while that's true, I can't imagine a case where you'd want to ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

hayksaakian on Dec 21, 2012 | parent | context | favorite | on: Explain SQL injection without technical jargon

Was not trolling. while that's true, I can't imagine a case where you'd want to run queries with JavaScript using unvalidated user input.

My point was that the default with SQL is to write your own queries whereas mongo has an abstraction layer by default.

saurik on Dec 25, 2012 [–]

Yet, this has happened before. "NoSQL Doesn’t Mean No SQL Injection"[1] You also need to worry about escaping $ operators in your query documents[2].

[1]: http://www.kalzumeus.com/2010/09/22/security-lessons-learned...

[2]: http://docs.mongodb.org/manual/faq/developers/#dollar-sign-o...

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact