Code Injection
Code injection is when an attacker injects executable code into a program and runs it through eval/exec or similar, achieving arbitrary code execution.
Purpose
To understand code injection caused by dynamically executing user input and its defenses; a common vulnerability in interpreted languages.
Mechanism
The program executes a user-controllable string via eval(input) or similar, and the attacker injects code statements. Defenses: avoid eval, parameterized APIs, input validation, sandboxing.
Use cases
- PHP/Python security audit
- eval vulnerability defense
- Dynamic execution risks