NoSQL injections can be prevented by escaping user-input's special characters that are passed into the NoSQL query from the user-supplied source.

Alternatively, using a sanitize library such as MongoSanitizer will ensure that user-supplied sources can not act as a malicious query.

</p>

<example>

<p>In the example below, the user-supplied source is passed to a MongoDB function that queries the MongoDB database.</p>

<sample src="examples/NoSQLInjection-bad.py" />

<p> This can be fixed by using a sanitizer library like MongoSanitizer as shown in this annotated code version below.</p>

<sample src="examples/NoSQLInjection-good.py" />

<references>

<li>Mongoengine: <a href="http://mongoengine.org/">Documentation</a>.</li>