Hi dericop
instead of using Ecto with MongoDB it is a better way to use the driver api without any additional layer.
Ecto is made for SQL and MongoDB is very different. But that’s a philosophical question. In my opinion, Ecto is not necessary for the use of MongoDB. An additional level between the driver and the program is superfluous because the MongoDB documents are returned as maps. If you prefer defstructs, you can convert the maps into such. Queries as SQL-DSL are more of a headache for MongoDB and are not useful. Why should one describe MongoDB queries as SQL?
SQL-Injection in MongoDB is hardly possible because the queries do not have to be expressed as a strings but as keyword lists or maps.
Example:
Mongo.find_one(:mongo, "accounts", %{username: name}, limit: 1)
In this case you are not able to fake the query, because the content of name is always treated as value whatever it is. You don’t need to escape values here.
Good luck!
