Query-operator injection is a flaw where attacker-controlled input is parsed as part of a database query instead of as plain data. In document databases and SQL-like query builders, special tokens and operators can change the logic of a filter, sort, or update operation. For example, if an application directly merges untrusted input into a query object, a user may be able to add operators that widen a search, bypass checks, or alter records.
This matters because it can turn a normal request into unauthorized data access or modification. In real attacks, it often appears in framework glue, API endpoints, or admin tools that build queries dynamically from request fields, JSON, or form data. Defenses include strict input validation, allowlists for field names and operators, parameterized or structured query APIs, and separating user data from query syntax. Review every layer that translates input into database operations, not just the database server itself.