Definition
Code Injection
A code injection vulnerability occurs when a server dynamically evaluates unsanitised attacker input as code in a host language, e.g. via
eval(),exec(), or a template engine that renders input as executable code. Unlike a command injection, the injected code runs in the host programming language rather than a shell, but the root cause is the same: mixing code and data into one string that is later evaluated.