What is injection attack?

An injection attack is a type of security vulnerability where an attacker inserts malicious input into a program in a way that gets interpreted as code or commands rather than harmless data. The most well-known example is SQL injection, where an attacker enters crafted text into a form field, like a login box, that manipulates a database query to bypass authentication or extract data it shouldn't have access to. Other common variants include command injection, where malicious input is executed as a system command, and cross-site scripting, where injected script runs in a victim's browser. Injection attacks succeed because an application fails to properly separate user input from executable instructions, essentially trusting data that should have been treated as untrusted. Defending against them generally involves input validation, parameterized queries or prepared statements, escaping special characters, and applying the principle of least privilege so a successful injection has limited damage potential. Injection has consistently ranked among the most critical web application security risks because it's both common and, when successful, capable of causing severe harm.