Code injection is a form of attack in which a malicious user:

In a code injection attack, a malicious user inputs a string into a data field (such as a form input, URL parameter, or API call) that the application fails to sanitize, causing the backend to parse and execute the input as code. Classic examples include SQL injection, LDAP injection, and OS command injection, where the injected text alters the intended logic of a query or command.

Executing arbitrary code via a buffer overflow is a memory corruption exploit, not code injection through a data field.

Inserting code into JavaScript running in the browser describes Cross-Site Scripting (XSS), which is a client-side injection attack distinct from server-side code injection.

Gaining access to the server codebase and inserting new code describes unauthorized code modification or a supply chain attack, not code injection.