thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Code Injection

A flaw in which input is evaluated as application code by the interpreter, such as through eval or dynamic includes.

Definition

Distinct from OS command injection, code injection runs in the language runtime (for example PHP, Python or JavaScript eval). It is tracked as CWE-94. Avoid dynamic evaluation of input, use safe parsers (JSON.parse rather than eval) and sandbox when unavoidable.

Example

A calculator feature passes user input to eval(), allowing arbitrary JavaScript execution on the server.

Exam tip

Code injection runs in the app's language; command injection runs in the OS shell.

Related terms