Injection
Untrusted data is slipped into an interpreter (SQL, OS commands, and so on), changing what the code was meant to do.
What is Injection?
Injection happens when user input is executed as part of a command or query instead of being treated purely as data. The interpreter (a SQL engine, a browser, a shell) can't tell which part the programmer wrote and which part the attacker slipped in, so it runs both. The two best-known forms are SQL Injection and Cross-Site Scripting (XSS); you can try both in the demo tabs.
SQL Injection: breaking the query logic
When a query is built by concatenating strings, a payload like ' OR '1'='1 can break out of the quotes and turn the WHERE clause always-true. That lets an attacker log in without a password, or read an entire table. The fix is bound parameters (a prepared statement) that treat input purely as data.
XSS: injecting scripts into the page
XSS happens when user input is echoed back as raw HTML. An attacker can slip in a <script> tag or an attribute like onerror that then runs in the victim's browser, for example to steal session cookies. The key is to always escape output for its context (for example using textContent instead of innerHTML).
Impact & prevention
Injection can lead to data theft, account takeover, and even command execution on the server. The prevention principle is the same across types: never mix data with code. Separate them through parameterization, context-aware escaping, and allowlist input validation.