> For the complete documentation index, see [llms.txt](https://book.redsquad.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.redsquad.xyz/web-hacking/injections.md).

# Injections

Injections are a security vulnerability in websites and web applications where attackers inject malicious code/data by exploiting a flaw in the way the application handles user input.

<figure><img src="https://media1.giphy.com/media/v1.Y2lkPTc5MGI3NjExYmRjMzE3YzAxNmUzZTgyMzkyYjRjZTk4MGExNjlhOGNjNjIyODBmZSZlcD12MV9pbnRlcm5hbF9naWZzX2dpZklkJmN0PWc/xT5LMUeCoYH1DEGCys/giphy.gif" alt="" width="188"><figcaption></figcaption></figure>

There are several types of injections that attackers can use to exploit vulnerabilities in web applications. Some of the most common include:

1. SQL injection: This occurs when an attacker is able to insert SQL commands into an application's database queries, allowing them to manipulate or extract sensitive data from the database.
2. Cross-site scripting (XSS) injection: This occurs when an attacker is able to inject malicious code into a web page that is executed by a victim's browser, allowing the attacker to steal sensitive data or take control of the victim's session.
3. Command injection: This occurs when an attacker is able to inject operating system commands into an application, allowing them to execute arbitrary code on the server.
4. LDAP injection: This occurs when an attacker is able to inject LDAP commands into an application, allowing them to manipulate or extract sensitive data from the application's directory services.

{% content-ref url="/pages/6rng3AXlnNvDY6jzkeyZ" %}
[SQLi](/web-hacking/injections/sqli.md)
{% endcontent-ref %}

{% content-ref url="/pages/6I7mA7ycLOBg1xspKrT3" %}
[HTML | XSS](/web-hacking/injections/html-or-xss.md)
{% endcontent-ref %}

{% content-ref url="/pages/hihpGkCOWrEQrp1ikO9R" %}
[XXE](/web-hacking/injections/xxe.md)
{% endcontent-ref %}