eoftedal

"As vulnerabilities are discovered in JavaScript libraries, it is vital that we update our dependencies. Retire.js is a command line scanner that helps you identify dependencies with known vulnerabilites in your application. Using the provided Grunt plugin you can easily include Retire.js into your build process. Retire.js also provides a chrome extension allowing you to detect libraries while surfing your website."

I assume this is trolling, but I'll answer anyways. SQL-injection is about using SQL databases the wrong way. NoSQL injection is about using NoSQL databases the wrong way. MongoDB had a NoSQL injection in it's PHP driver a while back. It's also prone to SQL-injection as noted in the documentation:

"MongoDB operations permit you to run arbitrary JavaScript expressions directly on the server: $where db.eval() mapReduce group You must exercise care in these cases to prevent users from submitting malicious JavaScript.

Fortunately, you can express most queries in MongoDB without JavaScript and for queries that require JavaScript, you can mix JavaScript and non-JavaScript in a single query."

So while it's certainly easier to avoid this kind of injection, it's certainly not bullet proof.

I think this is one of the best ways to explain SQL injection: http://i.telegraph.co.uk/multimedia/archive/01250/miss-you_1...

Clearly explains failure to seperate data from instruction.