Code Injection
Code injection is a security attack in which malicious code is introduced into a system and executed due to insufficient input validation or security controls.
“A type of security attack performed by inserting malicious code at an interface into an application to exploit poor handling of untrusted data.”
(Definition reproduced from the ISTQB Glossary. Copyright belongs to ISTQB.)
View the complete ISTQB GlossaryWhat is Code Injection?
Attackers exploit vulnerabilities to execute unauthorized commands or scripts, potentially compromising system security or data integrity.
Common types: SQL injection, command injection, and script injection.
Root cause: Poor input validation and unsafe code execution.
Testing focus: Security testing verifies that malicious input cannot be executed.
Real World Example
A tax calculation module applies different deductions depending on income band, residency status, and submitted documents.
Reviewing the final tax amount is not enough when important code paths may never execute during testing. Code injection helps the tester reason about the structure behind the result.
The tester works with the developer to identify decisions or paths in the calculation logic and designs inputs that exercise the meaningful alternatives.
The team gains better evidence about hidden logic because Code injection connects tests to the implementation structure where certain defects can hide.
Practice Questions
Question 1
Which check MOST reduces SQL injection risk?
Question 2
Which symptom MOST suggests command injection?
Test your knowledge with real ISTQB-style questions
You’ve learned Code Injection. Test your understanding with topic-specific questions in our Mock Exams.