When you build a MongoDB query from user input without sanitization, a user can send operators like $gt, $ne, $or to manipulate the query. Example: { email: { $gt: '' }, password: { $gt: '' } } bypasses login by matching the first user.

Use express-mongo-sanitize (strips $ and .), validate with Zod (enforces types), use Mongoose (casts based on schema), cast inputs explicitly with String(), avoid $where, and whitelist filter fields. Layer defenses.

Strips $ and . from req.body, req.params, and req.query. A payload of { email: { $gt: '' } } becomes { email: 'gt' }, which fails the query. Add it after express.json so all bodies are sanitized.