Injection and Unsafe Input
Injection occurs when untrusted input is interpreted as part of a command or query.
Examples include SQL injection, NoSQL injection, shell injection, template injection, LDAP injection, and command injection.
Use parameterized queries, safe query builders, allowlists, schema validation, escaping appropriate to the output context, and least-privilege database accounts.
Do not assume that using MongoDB makes an application immune to injection. Query objects, operators, aggregation pipelines, and dynamic expressions still require careful validation.
Never Trust Client Query Objects
Do not directly pass req.body, req.query, or req.params into database query APIs without validation and controlled mapping.