MongoDB Documentation, Release 3.0.4 • Embed documents. In some cases you may want to embed documents in other documents and save on the per-document overhead. For documents in a MongoDB collection, you should always use GridFS for storing files larger than 16 MB. In some situations, storing large files may be more efficient in a MongoDB database than on a system-level filesystem. Do not use GridFS if you need to update the content of the entire file atomically. As an alternative you can store multiple versions of each file and specify the current version of the file in the metadata. You can update the metadata field that indicates “latest” status in an atomic update after uploading the new version of the file, and later remove previous versions if needed. Furthermore, if your files are all smaller the 16 MB BSON Document Size limit, consider storing the file man- ually within a single document. You may use the BinData data type to store the binary data. See your drivers documentation for details on using BinData. For more information on GridFS, see GridFS (page 150). As a client program assembles a query in MongoDB, it builds a BSON object, not a string. Thus traditional SQL injection attacks are not a problem. More details and some nuances are covered below. MongoDB represents queries as BSON objects. Typically client libraries provide a convenient, injection free, process to build these objects. Consider the following C++ example: BSONObj my_query = BSON( "name" << a_name ); auto_ptr<DBClientCursor> cursor = c.query("tutorial.persons", my_query); 11.2.11 How does MongoDB address SQL or Query injection? BSON 11.2.10 When should I use GridFS? JavaScript • $where • mapReduce • If your filesystem limits the number of files in a directory, you can use GridFS to store as many files as needed. • When you want to keep your files and metadata automatically synced and deployed across a number of systems and facilities. When using geographically distributed replica sets (page 579) MongoDB can distribute files and their metadata automatically to a number of mongod instances and facilities. • When you want to access information from portions of large files without having to load whole files into memory, you can use GridFS to recall sections of files without reading the entire file into memory. Here, my_query then will have a value such as { name : "Joe" } . If my_query contained special charac- ters, for example , , : , and { , the query simply wouldn’t match any documents. For example, users cannot hijack a query and convert it to a delete. Note: You can disable all server-side execution of JavaScript, by passing the --noscripting option on the command line or setting security.javascriptEnabled in a configuration file. All of the following MongoDB operations permit you to run arbitrary JavaScript expressions directly on the server: 749 11.2. FAQ: MongoDB for Application Developers