Glossary term
What is command injection (OS command injection)?
command injection stands for OS command injection.
User input reaches a shell command, so characters like ; or && add extra commands. Prefer execFile or a library over exec.
Learn it properly · Security for DevelopersLesson 1: Injection: SQL Injection, Command Injection and How to Stop ThemA real SQL injection on a tiny login, then the fix with parameterised queries. Also command injection, NoSQL injection and the rule behind all of them: never mix data into code.