in the mongo documentation there is a caution around certain characters that are potentially vulnerable to sql injection.  Mongoose-strings provides a safety filter/unfilter for these characters and a .exists() method.