Code injection occurs when an attacker inserts malicious code into a website to alter its behavior. Depending on the attack, injected code may redirect visitors, steal information, display unwanted advertisements, or create hidden access points that allow future attacks.