NoSQL doesn't mean No Injection attacks. Just ask Patrick:
http://www.kalzumeus.com/2010/09/22/security-lessons-learned...
http://www.kalzumeus.com/2010/09/22/security-lessons-learned...
If you don't properly understand your database (or any other tech), assuming it doesn't have security issues because it is 'different' is the height of naivety...