thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Injection

OWASP Top 10 category for flaws where untrusted data is sent to an interpreter as part of a command or query.

Definition

Covers SQL, NoSQL, OS command, LDAP, XPath, expression language and template injection, and since 2021 also cross-site scripting. Root cause is mixing code and data. Mitigations include parameterized APIs, context-aware output encoding, allowlist validation and least-privileged interpreter accounts.

Example

A search box value is concatenated into a SQL statement and alters the query logic.

Exam tip

XSS was merged into Injection in 2021; parameterization is the primary fix (A03 in 2021, A05 in 2025).

Related terms