Code injection is a form of attack in which a malicious user:

Inserts text into a data field that gets interpreted as code

Gets the server to execute arbitrary code using a buffer overflow

Inserts additional code into the JavaScript running in the browser

Gains access to the codebase on the server and inserts new code