Injection Attacks

Injection attacks occur when an attacker sends untrusted data to an interpreter as part of a command or query. The interpreter executes the malicious input, allowing the attacker to access data, modify records, or execute system commands. Injection has been one of the most dangerous web application vulnerabilities for over two decades.

---

How Injection Works

The fundamental cause of injection is mixing code with data. When user input is concatenated directly into a command or query without proper handling, the interpreter cannot distinguish between the intended command and the attacker's input.

Trusted Command + Untrusted User Input = Potentially Malicious Command

---

Types of Injection Attacks