Injection happens when untrusted data is interpreted as code. The interpreter can be SQL, a shell, an HTML page, a template engine or a file path. The fix is almost always the same: keep data and code separate.
SQL injection
Unsafe code concatenates input into a query:
"SELECT * FROM users WHERE email = '" + email + "'"
If email is ' OR '1'='1, the query changes meaning. The database executes what the attacker supplied.
Parameterised queries send the SQL structure and the data separately:
SELECT * FROM users WHERE email = $1
The database treats $1 as a value, not syntax.
Command injection
Unsafe code builds a shell command from input:
ping -c 1 " + host
If host contains ; rm -rf /, the shell may run both commands. Avoid the shell entirely, use argument arrays and validate against an allow-list.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.