Fix NoSQL Injection in Laravel

Laravel applications using NoSQL drivers like MongoDB are susceptible to operator injection if input types aren't strictly enforced. Attackers bypass logic by passing arrays containing operators like $ne (not equal) or $gt (greater than) instead of strings, effectively turning a specific query into a broad boolean true.

The Vulnerable Pattern

$user = User::where('username', $request->input('username'))
            ->where('password', $request->input('password'))
            ->first();
// Attack Payload: POST /login { “username”: “admin”, “password”: { “$ne”: "" } }

The Secure Implementation

The vulnerability exists because the underlying NoSQL driver accepts arrays as query values. By passing an object/array instead of a string, the attacker injects MongoDB logic. To fix this, use Laravel's Validator to enforce 'string' types, which rejects array inputs. Additionally, explicitly type-cast inputs to (string) before passing them to the Eloquent builder to ensure the driver treats the value as a literal value rather than an operator object.

$validated = $request->validate([
    'username' => 'required|string',
    'password' => 'required|string',
]);
$user = User::where(‘username’, (string) $validated[‘username’])
->where(‘password’, (string) $validated[‘password’])
->first();