Inspecting developer code for functions like system, exec, and popen is recommended to reduce the likelihood of what type of public-facing attack?

SQL injection exploits unsanitized input passed to database query functions, not OS shell execution functions like exec() or popen().

Cross-site scripting involves injecting malicious scripts into web output rendered by a browser, not OS-level command execution functions.

Command injection occurs when an attacker supplies OS-level commands through application input that is passed unsanitized to shell execution functions such as system(), exec(), or popen(). Auditing developer code for these function calls identifies where user-controlled data may reach the OS shell. Eliminating or sanitizing these calls directly reduces the attack surface for command injection on public-facing applications.

Server-side request forgery exploits the server making HTTP requests to attacker-controlled endpoints, unrelated to shell execution functions.