What is Injection?
1 min read
Updated 2026-02-05
A class of vulnerabilities where untrusted data is sent to an interpreter as part of a command or query. Includes SQL injection, NoSQL injection, and command injection.
Understanding Injection
Injection vulnerabilities occur when an application sends untrusted data to an interpreter. The attacker's hostile data tricks the interpreter into executing unintended commands or accessing unauthorized data. Injection has been in the OWASP Top 10 since its inception.
Examples
- SQL injection: ' OR 1=1 -- in a login form
- Command injection: ; rm -rf / in a filename parameter
- LDAP injection in authentication queries
- XPath injection in XML queries
How to Prevent
- Use parameterized queries / prepared statements
- Use ORM frameworks correctly
- Validate and sanitize all user input
- Apply least privilege to database accounts
- Use allowlists for command arguments
Worried about Injection in your app?
Our security audits identify vulnerabilities like this before attackers do. Get expert manual review of your codebase.