Most developers coming from a SQL background know to worry about SQL injection instinctively, string concatenation into a raw query feels obviously dangerous. MongoDB's query syntax being actual JavaScript objects creates a different, less intuitive version of the same underlying problem, and it's genuinely easy to introduce without it looking wrong at all.

The Vulnerable Version

// app/api/login/route.ts

export async function POST(request: Request) {

const body = await request.json();