Avoiding code injections with c# Driver for MongoDB
As the documentation states, the biggest area you need to watch out for is db.eval(). The .eval() method for the driver is going to be translated to equivalent javascript .eval function. You want to be extra careful when using .eval in javascript because it executes the code in ().