Fix NoSQL Injection in Phalcon

Phalcon's ODM for MongoDB is fast, but it doesn't automatically sanitize against operator injection. If you're passing raw request arrays directly into your find methods, you're vulnerable. Attackers can inject MongoDB operators like $gt, $ne, or $regex to bypass authentication or exfiltrate the entire collection. In Phalcon, the lack of strict schema enforcement at the ODM level means you must manually enforce data types.

The Vulnerable Pattern

$user = Users::findFirst([
    [
        'email' => $this->request->getPost('email'),
        'password' => $this->request->getPost('password')
    ]
]);

The Secure Implementation

The vulnerability occurs because Phalcon/MongoDB accepts associative arrays as query parameters. An attacker can send a POST request like `email[$ne]=null`, which translates to a query looking for any user where the email is NOT null—effectively logging in as the first user in the DB. To fix this, use Phalcon's built-in filtering service to sanitize inputs and explicitly cast values to strings. This prevents the ODM from interpreting user-supplied nested arrays as MongoDB query operators.

$email = $this->request->getPost('email', 'string');
$password = $this->request->getPost('password', 'string');
$user = Users::findFirst([
[
‘email’ => (string) $email,
‘password’ => (string) $password
]
]);