Fix NoSQL Injection in FuelPHP

NoSQL injection in FuelPHP typically manifests when using the Mongo_Db package. Attackers exploit PHP's associative array handling to inject MongoDB operators like $ne (not equal) or $gt (greater than) into query filters. If your application accepts raw arrays from Input::post() or Input::get() and passes them directly to the database driver, an attacker can bypass authentication or dump the entire collection.

The Vulnerable Pattern

$username = Input::post('username');
$password = Input::post('password');
// VULNERABLE: Passing raw input directly into a filter array.
// Attacker sends: password[$ne]=1
$user = Mongo_Db::instance()->where(array(
‘user’ => $username,
‘pass’ => $password
))->get(‘users’);

The Secure Implementation

The exploit occurs because PHP translates 'password[$ne]=1' into an associative array ['password' => ['$ne' => '1']]. When the Mongo_Db driver receives this, it executes a 'not equal' query instead of a literal string match. To remediate, you must strictly cast inputs to strings and avoid passing user-controlled associative arrays to query builders. Using the fluent interface (where('key', 'value')) ensures the value is treated as a literal rather than a query structure.

$username = (string) Input::post('username');
$password = (string) Input::post('password');
// SECURE: Explicit type casting and using key-value pairs in the where method.
// This prevents the driver from interpreting input as a nested operator array.
$user = Mongo_Db::instance()
->where(‘user’, $username)
->where(‘pass’, $password)
->get(‘users’);