Definition
Code injection tricks programs into executing attacker-controlled code:
In SCU terms: Code injection causes programs to process malicious χ-mode sequences as legitimate code—blurring the boundary between data and execution.
The Fundamental Problem
Programs mix data and code χ-modes:
If boundaries aren't maintained, data becomes code.
Injection Types
| Type | χ-Mode Target |
|---|---|
| SQL injection | Database query χ-modes |
| Command injection | Shell command χ-modes |
| XSS | Browser script χ-modes |
| Code injection | Program execution χ-modes |
| LDAP injection | Directory query χ-modes |
SQL Injection Example
If input = "1; DROP TABLE users":
Injected χ-modes execute as SQL commands.
χ-Mode Boundary Violation
Injection succeeds when:
Prevention requires maintaining boundaries.
Prevention Techniques
| Technique | How It Protects |
|---|---|
| Input validation | Filter dangerous χ-modes |
| Parameterized queries | Separate data/code χ-modes |
| Output encoding | Escape χ-mode control characters |
| Least privilege | Limit χ-mode execution rights |
Why Injection is Dangerous
Injected χ-modes execute with program privileges:
- Database access
- System commands
- User sessions
- File system access
The Key Insight
Code injection blurs data and code χ-modes.
Security requires maintaining χ-mode boundaries:
- Data and code are both χ-mode configurations
- Programs must distinguish them
- Injection attacks cross boundaries
- Validation maintains separation
When code injection succeeds, attacker-controlled χ-mode sequences execute as trusted code—because the program failed to maintain the boundary between data and execution.