Code injection

---

title: "Code injection" type: doc version: 1 created: 2026-02-28 author: "Wikipedia contributors" status: active scope: public tags: ["types-of-malware", "injection-exploits", "machine-code", "articles-with-example-c-code"] description: "Computer bug exploit caused by invalid data" topic_path: "general/types-of-malware" source: "https://en.wikipedia.org/wiki/Code_injection" license: "CC BY-SA 4.0" wikipedia_page_id: 0 wikipedia_revision_id: 0

::summary Computer bug exploit caused by invalid data ::

An SQL injection takes advantage of SQL syntax to inject malicious commands that can read or modify a database or compromise the meaning of the original query.

For example, consider a web page that has two text fields which allow users to enter a username and a password. The code behind the page will generate an SQL query to check the password against the list of user names: ::code[lang=SQL] SELECT UserList.Username FROM UserList WHERE UserList.Username = 'Username' AND UserList.Password = 'Password' ::

If this query returns any rows, then access is granted. However, if the malicious user enters a valid Username and injects some valid code "('Password' OR '1'='1') in the Password field, then the resulting query will look like this: ::code[lang=sql] SELECT UserList.Username FROM UserList WHERE UserList.Username = 'Username' AND UserList.Password = 'Password' OR '1'='1' ::

In the example above, "Password" is assumed to be blank or some innocuous string. "'1'='1'" will always be true and many rows will be returned, thereby allowing access.

The technique may be refined to allow multiple statements to run or even to load up and run external programs.

Assume a query with the following format: SELECT User.UserID FROM User WHERE User.UserID = ' " + UserID + " ' AND User.Pwd = ' " + Password + " ' If an adversary has the following for inputs:

UserID: ';DROP TABLE User; --'

Password: 'OR"='

then the query will be parsed as: SELECT User.UserID FROM User WHERE User.UserID = *;DROP TABLE User; --'AND Pwd = *OR"='

The resulting User table will be removed from the database. This occurs because the ; symbol signifies the end of one command and the start of a new one. -- signifies the start of a comment.

Cross-site scripting

Main article: Cross-site scripting

Code injection is the malicious injection or introduction of code into an application. Some web servers have a guestbook script, which accepts small messages from users and typically receives messages such as: Very nice site! However, a malicious person may know of a code injection vulnerability in the guestbook and enter a message such as: ::code[lang=html] Nice site, I think I'll take it. If another user views the page, then the injected code will be executed. This code can allow the attacker to impersonate another user. However, this same software bug can be accidentally triggered by an unassuming user, which will cause the website to display bad HTML code.

HTML and script injection are popular subjects, commonly termed "[[cross-site scripting]]" or "XSS". XSS refers to an injection flaw whereby user input to a web script or something along such lines is placed into the output HTML without being checked for HTML code or scripting.

Many of these problems are related to erroneous assumptions of what input data is possible or the effects of special data.{{cite book|last1=Hope|first1=Brian|last2=Hope|first2=Paco|last3=Walther|first3=Ben|title=Web Security Testing Cookbook|url=https://archive.org/details/websecuritytesti00hope|url-access=registration|date=15 May 2009|publisher=[[O'Reilly Media]]|location=Sebastopol, CA|isbn=978-0-596-51483-9|page=[https://archive.org/details/websecuritytesti00hope/page/254 254]|oclc=297573828}}

=== Server Side Template Injection === [[Web template system|Template engines]] are often used in modern [[web application]]s to display dynamic data. However, trusting non-validated user data can frequently lead to critical vulnerabilities{{Cite web |date=2015-08-05 |title=Server-Side Template Injection |url=https://portswigger.net/research/server-side-template-injection |access-date=2022-05-22 |website=PortSwigger Research |archive-date=22 May 2022 |archive-url=https://web.archive.org/web/20220522214453/https://portswigger.net/research/server-side-template-injection |url-status=live }} such as server-side Side Template Injections. While this vulnerability is similar to [[cross-site scripting]], template injection can be leveraged to execute code on the web server rather than in a visitor's browser. It abuses a common workflow of web applications, which often use user inputs and templates to render a web page. The example below shows the concept. Here the template {{visitor_name}} is replaced with data during the rendering process. Hello {{visitor_name}}

An attacker can use this workflow to inject code into the rendering pipeline by providing a malicious visitor_name. Depending on the implementation of the web application, he could choose to inject {{7*'7'}} which the renderer could resolve to Hello 7777777. Note that the actual web server has evaluated the malicious code and therefore could be vulnerable to [[remote code execution]]. ::

Dynamic evaluation vulnerabilities

An eval() injection vulnerability occurs when an attacker can control all or part of an input string that is fed into an eval() function call. ::code[lang=php] $myvar = 'somevalue'; $x = $_GET['arg']; eval('$myvar = ' . $x . ';'); ::

The argument of "[eval](eval)" will be processed as PHP, so additional commands can be appended. For example, if "arg" is set to "10; system('/bin/echo uh-oh')", additional code is run which executes a program on the server, in this case "/bin/echo".

Object injection

PHP allows serialization and deserialization of whole objects. If an untrusted input is allowed into the deserialization function, it is possible to overwrite existing classes in the program and execute malicious attacks. Such an attack on Joomla was found in 2013.

Remote file injection

Main article: File inclusion vulnerability

Consider this PHP program (which includes a file specified by request): ::code[lang=php]