Skip to content
SelfSec
Join the launch listLaunch list
SelfSec
Vulnerability field guide

NoSQL Injection

Switching from SQL to a document database does not remove injection — it changes the syntax. Learn how attacker-controlled types and operators rewrite filters, and how explicit schemas keep query structure on the server.

3 articles 14 min total Overview to advanced techniques

Start with the overview

NoSQL Injection6 min read

NoSQL Injection: When JSON Operators Rewrite a Query

Switching from SQL to a document database does not remove injection — it changes the syntax. Learn how attacker-controlled types and operators rewrite filters, and how explicit schemas keep query structure on the server.

Read the overview

NoSQL Injection techniques

2 focused deep-dives
  1. 02 Operator InjectionNoSQL Operator Injection: When a Scalar Field Becomes a Filter 4 min
  2. 03 Server-Side JavaScriptMongoDB JavaScript Injection: Why $where Must Stay Server-Owned 4 min