Injection attacks are caused by a lack of rigorous separation between programme instructions (code) and user-supplied (or external) input. An attacker can use this to inject malicious code into a data snippet.