If you are passing $_GET (or $_POST)
parameters to your queries, make sure that they are cast to strings first.
Users can insert associative arrays in GET and POST requests, which could
then become unwanted $-queries.
A fairly innocuous example: suppose you are looking up a user's information
with the request http://www.example.com?username=bob.
Your application creates the query
$q = new \MongoDB\Driver\Query( [ 'username' => $_GET['username'] ]).
Someone could subvert this by getting
http://www.example.com?username[$ne]=foo, which PHP
will magically turn into an associative array, turning your query into
$q = new \MongoDB\Driver\Query( [ 'username' => [ '$ne' => 'foo' ] ] ),
which will return all users not named "foo" (all of your users, probably).
This is a fairly easy attack to defend against: make sure $_GET and $_POST parameters are the type you expect before you send them to the database. PHP has the filter_var() function to assist with this.
Note that this type of attack can be used with any database interaction that locates a document, including updates, upserts, deletes, and findAndModify commands.
See » the main documentation for more information about SQL-injection-like issues with MongoDB.