MongoDB Documentation, Release 3.0.4 • group You must exercise care in these cases to prevent users from submitting malicious JavaScript. Fortunately, you can express most queries in MongoDB without JavaScript and for queries that require JavaScript, you can mix JavaScript and non-JavaScript in a single query. Place all the user-supplied fields directly in a BSON field and pass JavaScript code to the $where field. If you need to pass user-supplied values in a $where clause, you may escape these values with the CodeWScope mechanism. When you set user-submitted values as variables in the scope document, you can avoid evaluating them on the database server. Field names in MongoDB’s query language have semantic meaning. The dollar sign (i.e $ ) is a reserved character used to represent operators (i.e. $inc .) Thus, you should ensure that your application’s users cannot inject operators into their inputs. In some cases, you may wish to build a BSON object with a user-provided key. In these situations, keys will need to substitute the reserved $ and . characters. Any character is sufficient, but consider using the Unicode full width equivalents: U+FF04 (i.e. “$”) and U+FF0E (i.e. “.”). The user may have supplied a $ value in the a_key value. At the same time, my_object might be { $where : "things" } . Consider the following cases: Dollar Sign Operator Escaping Consider the following example: BSONObj my_object = BSON( a_key << a_name ); • Insert . Inserting this into the database does no harm. The insert process does not evaluate the object as a query. Note: MongoDB client drivers, if properly implemented, check for reserved characters in keys on inserts. • Update . The update() operation permits $ operators in the update argument but does not support the $where operator. Still, some users may be able to inject operators that can manipulate a single document only. Therefore your application should escape keys, as mentioned above, if reserved characters are possible. • Query Generally this is not a problem for queries that resemble { x : user_obj } : dollar signs are not top level and have no effect. Theoretically it may be possible for the user to build a query themselves. But checking the user-submitted content for $ characters in key names may help protect against this kind of injection. Driver-Specific Issues See the “PHP MongoDB Driver Security Notes$^{8}$” page in the PHP driver documentation for more information MongoDB implements a readers-writer lock. This means that at any one time, only one client may be writing or any number of clients may be reading, but that reading and writing cannot occur simultaneously. In standalone and replica sets the lock’s scope applies to a single mongod instance or primary instance. In a sharded cluster, locks apply to each individual shard, not to the whole cluster. For more information, see FAQ: Concurrency (page 758). $^{8}$http://us.php.net/manual/en/mongo.security.php 750 Chapter 11. Frequently Asked Questions 11.2.12 How does MongoDB provide concurrency?