MongoDB injection occurs when untrusted input influences database query operators or query structure.

For example, an application should never accept arbitrary MongoDB filters directly from the client.

Avoid patterns such as:

User.find(req.query);

A malicious client might provide unexpected operator structures.

Instead:

• Validate query parameters.
• Allowlist supported filter fields.
• Convert values to expected data types.
• Avoid blindly spreading request objects into database operations.
• Use controlled query builders.

const filter = {};

if (typeof req.query.email === 'string') {
  filter.email = req.query.email.toLowerCase().trim();
}

if (typeof req.query.isActive === 'string') {
  if (req.query.isActive === 'true') {
    filter.isActive = true;
  } else if (req.query.isActive === 'false') {
    filter.isActive = false;
  }
}

const users = await User.find(filter).select('-password');