Injection is a broad class of security vulnerability in which an attacker sends untrusted, malicious data to an application in a way that tricks an interpreter into executing unintended commands or accessing unauthorized data. The core flaw is that the application fails to properly separate data from commands: when user-supplied input is inserted into a query, command, or instruction without adequate validation or sanitization, the interpreter cannot tell the attacker’s injected content apart from legitimate instructions, and executes it. Injection has long been one of the most serious and well-known categories in the OWASP Top 10.
There are many types of injection, corresponding to the different interpreters an application uses. SQL injection is the classic and most notorious example: an attacker inserts malicious SQL into an input that gets incorporated into a database query, potentially allowing them to read, modify, or delete data, bypass authentication, or in severe cases take control of the database. Other forms include command injection (executing operating-system commands on the server), LDAP injection, NoSQL injection, XML injection, and cross-site scripting (which is injection of malicious scripts into web pages). In each case, the mechanism is the same: untrusted input crossing into an interpreter that treats part of it as executable instructions.
The impact of injection can be severe and wide-ranging: unauthorized data access and theft, data corruption or destruction, authentication bypass, and sometimes complete system compromise through remote code execution. Because injection can target the data and logic at the heart of an application, successful attacks can be devastating.
In APIs, injection remains a relevant risk because APIs accept input that is frequently passed to databases, interpreters, and downstream services. It carried over into the OWASP API Security Top 10 as one of the recognized API risks.
Preventing injection centers on never trusting user input and keeping data strictly separated from commands. Key defenses include using parameterized queries and prepared statements (so input is always treated as data, never as executable code), employing safe APIs and object-relational mapping that avoid raw query construction, validating and sanitizing all input against strict expectations, escaping output appropriately for the context, and applying least-privilege principles so that even a successful injection has limited reach. Fundamentally, injection is prevented by ensuring the interpreter can never mistake attacker-controlled data for instructions.