Hacker News Reader

It's almost as if constructing SQL queries by concatenating strings from user input is a bad idea.

I don't see how using vanilla mongo in the same fashion would solve the blight you have placed on SQL.

In Mongo, `db.findOne({"username":"$_GET["name"], "password":$_GET["password"]})` won't open your database to the public.

While SQL is a powerful language, the article is right. Mongo query language is useful enough to easily give application developers a place to query and store data without giving them enough rope to hang themselves.

Reply on news.ycombinator.com