I suggest using injection only for injection attacks where there is not a more specific injection tag available.
For instance, you asked about what the tags should be on Should IP addresses be validated to prevent SQL Injection?. By my guidelines above, the right set of tags is sql-injection but not injection.
First, I added the injection tag to Should IP addresses be validated to prevent SQL Injection?.
Well tagging question, except when the scope of the tag is really obvious, I usually consult the help text of the tag:
In this case the help text explicitly makes the tag appropriate for both SQL injection and XSS.
(When the help text is too vague, unclear, or even missing, I see which other questions use the tag and try to stay consistent with existing usage.)