Q: Should I move to MongoDB to avoid SQL injection vulnerability in Rails? There is a big concern regarding a recently-disclosed Rails SQL injection vulnerability. I am not well-versed in dealing with security, so I am unnerved. I hear that MongoDB is not susceptible to this kind of attack.
Is this a good reason to move to MongoDB permanently?

A: No. Just because SQL databases are vulnerable to SQL injection attacks is not a good reason to move to MongoDB.
MongoDB is great in certain use-cases, particularly where you need schema-less collections.
If you need to store relational data, you'll be much better served by a relational DB.
In short, if you're afraid of SQL injection, learn how to sanitize your inputs. Don't move to MongoDB.
The newly found vulnerability does not affect everyone. Read here for more details.

A: SQL != NoSQL
A relational database using SQL is not a feature-by-feature replacement for NoSQL. Depending on your problem domain, you can sometimes make different architectural or design decisions that favor one over the other, but you can't simply swap them out like spare parts because they have very different design goals and performance characteristics.
All Software Has Risks
Software security is a big topic, and well outside the scope of an SO question. However, switching from a product that is widely used and quickly patched to a product that you don't understand is not inherently a good risk management trade-off.
In point of fact, the vulnerability you're referring to is a Rails vulnerability that has since been patched; you have zero guarantees that there won't be other Ruby or Rails vulnerabilities in the future---or, in fact, network or OS vulnerabilities---that target different parts of the MVC or OS stack. Therefore, I'm not sure what you think you'd gain from a risk-management perspective by painting SQL as the inherent villain in this story.

A: SQL injections are a problem which is known for decades and well-understood. There are coding practices which make SQL injections completely impossible when you adhere to them:


*

*Run all variables through escape functions before putting them into a query

*Use prepared statements

*Use stored procedures


Always use at least one of these practices, and you don't have to be afraid of SQL injections.
MongoDB, on the other hand, is a rather new technology. It is not known yet what kind of newbie mistakes will be the most typical which lead to vulnerable applications. Maybe there is something just as bad as SQL injections everybody is doing right now without realizing. Maybe the exploit is already circulating among the black hat hackers. Who knows?
Also, as CodeGnome pointed out, MongoDB is not a drop-in replacement for an SQL database. It has a completely different philosophy. 83% of all MongoDB questions around here are asked by people who try to use MongoDB as if it were a relational database and wonder why it doesn't work out.
