[ponyous]

+ even this is not entirely true. In PHP you can inject into Mongo using nested arrays.

:( We are not safe