What is injection?

In the context of software security, injection is a broad class of vulnerabilities that occur when untrusted data is sent to an interpreter as part of a command or query. The interpreter then executes unintended commands due to the malicious injection. Common examples include SQL injection, where malicious SQL code is inserted into database queries; and command injection, where operating system commands are executed. Injection flaws are often caused by a lack of proper input validation and sanitization, allowing attackers to manipulate the application's logic or access sensitive data.