As is often the case with injection vulnerabilities, you must sanitize the user-supplied input to prevent NoSQL injections. It’s very important to strictly validate any user-supplied input before it makes its way to any query string, NoSQL databases are not an exception to this rule!