title: Why is JQuery casting a string to _id for Mongodb in this? (Please read EDIT)
body: <p>I have a route that adds an image (a meme) like this:</p>
  
  <pre><code>// add new image by URL
  app.post('/api/addMeme', function (req, res) {
      var meme = new Meme({
          title: req.body.title.trim().toLowerCase(),
          image: req.body.image,
          meta: {
              votes: 0,
              favs: 0
          },
          related: []
      });
  
      // Save meme to database
      meme.save(function (err) {
          if (err) throw err;
          Meme.find({}, function (err, meme) {
              if (err) throw err;
              io.emit('new meme', meme);
          });
          res.send('Succesfully inserted meme.');
      });
  });
  </code></pre>
  
  <p>It takes the only two attribute <code>title</code> and <code>image</code> given by client side <code>ajax</code> and add it to my <code>Mongodb</code> database named <code>Meme</code>. Emit the updated database using <code>socket.io</code>. Both <code>title</code> and <code>image</code> are <code>String</code> type. <code>image</code> is suppose to be an URL to an image.</p>
  
  <p>Now, I'm not ashamed to admit it, but my friend trolled my site and sent <code>image = "www.pornhub.com"</code> to this route and it crashed my database/site. Whenever I go and try to retrieve the image by its <code>_id</code>, I get the error:</p>
  
  <pre><code>CastError: Cast to ObjectId failed for value "www.pornhub.com" at path "_id" for model "meme"
  </code></pre>
  
  <hr>
  
  <p>EDIT: it looks like the error is actually coming from the route</p>
  
  <pre><code>app.post('/api/vote', function(req, res){
      Meme.findOneAndUpdate({_id: req.body.id}, {$inc : {'meta.votes' : 1}}, {new: true}, function (err, meme) {
          if (err) throw err;
          if (!meme) return res.send('No meme found with that ID.');
          io.emit('new vote', meme);
          res.send('Succesfully voted meme.');
      });
  });
  </code></pre>
  
  <p>where a <code>POST</code> request is updating the database, and there's a cast error where the <code>_id</code> is given as a string? </p>
  
  <p>The client side script that's doing this is</p>
  
  <pre><code>$("#vote").click(function(){
      $.ajax({
          type: "POST",
          url: '/api/vote',
          data: {
              id: App.meme._id
          },
          success: function (data, status) {
              console.log(data);
          }
      });
      return false;
  }); 
  </code></pre>
  
  <p>where <code>App</code> is a <code>Express-state</code> exposed data for which <code>meme</code>, the database, lives under.</p>
  
  <p>But this error ONLY occurs on the object with <code>image = "www.pornhub.com"</code>. My guess is that somewhere in the HTML, a cross-site <code>href</code> is visiting <code>www.pornhub.com</code> and somehow <code>App</code> is getting distorted? It doesn't fully make sense why <code>id: App.meme._id</code> would give <code>www.pornhub.com</code> as its value.</p>