title: How does MongoDB avoid the SQL injection mess?
body: <p>I was reading my trusty O'Reilly book and came across a passage about how Mongo, by nature, avoids the morass of SQL injection-like flaws.</p>
  
  <p>In my gut, I think I understand this. If unsanitized vars are passed into queries, they can't break out of the document-oriented query structure with a <code>UNION</code>, <code>JOIN</code>, query turned comment, etc.</p>
  
  <p>How does MongoDB avoid the SQL injection mess? Is it just by nature of this query syntax?</p>