COMPSCI 123: Introduction to NoSQL Injection Introduction to NoSQL | 2026 Update

2. Introduction to NoSQL Injection
Introduction to NoSQL


Background
Many applications rely on databases to store data, such as passwords, email addresses, or
comments. The most popular database engines are relational (e.g. Oracle and MySQL).
However, over the past decade, non-relational databases, also known as NoSQL
databases, have become increasingly more common, with MongoDB now being the 5th most
used database engine (as of November 2022).

There are four main types of NoSQL databases, and unlike relational databases, which
all store data similarly in tables , rows , and columns , the way NoSQL databases store
data varies significantly across the different categories and implementations.
r
.i

Type Description Top 3 Engines (as of
01


November 2022)
Document- Stores data in documents which contain MongoDB, Amazon
de




Oriented pairs of fields and values . These DynamoDB, Google
Database documents are typically encoded in formats Firebase - Cloud
hi




such as JSON or XML . Firestore
Key-Value A data structure that stores data in Redis, Amazon
Database key:value pairs, also known as a DynamoDB, Azure
dictionary . Cosmos DB
Wide-Column Used for storing enormous amounts of data Apache Cassandra,
Store in tables , rows , and columns like a Apache HBase, Azure
relational database, but with the ability to Cosmos DB
handle more ambiguous data types.
Graph Stores data in nodes and uses edges to Neo4j, Azure Cosmos
Database define relationships. DB, Virtuoso


In this module, we will focus solely on MongoDB , as it is the most popular NoSQL database.




Introduction to MongoDB


https://t.me/CyberFreeCourses

,MongoDB is a document-oriented database, which means data is stored in collections
of documents composed of fields and values . In MongoDB , these documents are
encoded in BSON (Binary JSON). An example of a document that may be stored in a
MongoDB database is:


{
_id: ObjectId("63651456d18bf6c01b8eeae9"),
type: 'Granny Smith',
price: 0.65
}




Here we can see the document's fields (type, price) and their respective values ('Granny
Smith', '0.65'). The field _id is reserved by MongoDB to act as a document's primary key ,
and it must be unique throughout the entire collection .

Connecting to MongoDB
We can use mongosh to interact with a MongoDB database from the command line by
passing the connection string. Note that 27017/tcp is the default port for MongoDB.
r
.i

mongosh mongodb://127.0.0.1:27017
01


Current Mongosh Log ID: 636510136bfa115e590dae03
de




Connecting to: mongodb://127.0.0.1:27017/?
directConnection=true&serverSelectionTimeoutMS=2000&appName=mongosh+1.6.0
hi




Using MongoDB: 6.0.2
Using Mongosh: 1.6.0


For mongosh info see: https://docs.mongodb.com/mongodb-shell/


test>




We can check which databases exist like this:


test> show databases
admin 72.00 KiB
config 108.00 KiB
local 40.00 KiB




Creating a Database

MongoDB does not create a database until you first store data in that database . We can
"switch" to a new database called academy by using the use command:
https://t.me/CyberFreeCourses

, test> use academy
switched to db academy
academy>




We can list all collections in a database with show collections .

Inserting Data
Similarly to creating a database, MongoDB only creates a collection when you first insert
a document into that collection . We can insert data into a collection in several ways.

We can insert a single document into the apples collection like this:


academy> db.apples.insertOne({type: "Granny Smith", price: 0.65})
{
acknowledged: true,
insertedId: ObjectId("63651456d18bf6c01b8eeae9")
}
r
.i

And we can insert multiple documents into the apples collection like this:
01


academy> db.apples.insertMany([{type: "Golden Delicious", price: 0.79},
de




{type: "Pink Lady", price: 0.90}])
{
hi




acknowledged: true,
insertedIds: {
'0': ObjectId("6365147cd18bf6c01b8eeaea"),
'1': ObjectId("6365147cd18bf6c01b8eeaeb")
}
}




Selecting Data

Let's say we wanted to check the price of Granny Smith apples. One way to do this is by
specifying a document with fields and values we want to match:


academy> db.apples.find({type: "Granny Smith"})
{
_id: ObjectId("63651456d18bf6c01b8eeae9"),
type: 'Granny Smith',
price: 0.65
}



https://t.me/CyberFreeCourses

, Or perhaps we wanted to list all documents in the collection. We can do this by passing an
empty document (since it is a subset of all documents):


academy> db.apples.find({})
[
{
_id: ObjectId("63651456d18bf6c01b8eeae9"),
type: 'Granny Smith',
price: 0.65
},
{
_id: ObjectId("6365147cd18bf6c01b8eeaea"),
type: 'Golden Delicious',
price: 0.79
},
{
_id: ObjectId("6365147cd18bf6c01b8eeaeb"),
type: 'Pink Lady',
price: 0.90
}
]
r
.i
01


If we wanted to do more advanced queries, such as finding all apples whose type
starts with a 'G' and whose price is less than 0.70 , we would have to use a
de




combination of query operators. There are many query operators in MongoDB, but some
of the most common are:
hi




Type Operator Description Example
Comparison $eq Matches values which are type: {$eq: "Pink Lady"}
equal to a specified value

Comparison $gt Matches values which are price: {$gt: 0.30}
greater than a specified
value
Comparison $gte Matches values which are price: {$gte: 0.50}
greater than or equal to
a specified value
Comparison $in Matches values which exist type: {$in: ["Granny
in the specified array Smith", "Pink Lady"]}

Comparison $lt Matches values which are price: {$lt: 0.60}
less than a specified value

Comparison $lte Matches values which are price: {$lte: 0.75}
less than or equal to a
specified value


https://t.me/CyberFreeCourses