Data injection (or data insertion) occurs when input fields are populated with control or command sequences embedded in various ways that are nevertheless accepted by the application, or possibly passed to the operating system, that allow privileged malicious and unauthorized programs to be run on the remote system.