There is . But except this tag there are also , , etc.

Should all questions with those tags be also tagged with ? If not, when should be used?

For example, is usage of appropriate in this question?

2 Answers 2


I suggest using only for injection attacks where there is not a more specific injection tag available.

For instance, you asked about what the tags should be on Should IP addresses be validated to prevent SQL Injection?. By my guidelines above, the right set of tags is but not .

  • Definitely agree here - because XSS, SQLi and Path injection are well known, definite types of attack it aids clarity to specify the tag. For others the generic injection tag is useful. If a new class of injection attacks becomes common, it may then make sense to create a new specific one.
    – Rory Alsop Mod
    Jul 25, 2012 at 20:07
  • 1
    Tag descriptions should describe appropriate usage.
    – curiousguy
    Aug 1, 2012 at 14:43

First, I added the tag to Should IP addresses be validated to prevent SQL Injection?.

Well tagging question, except when the scope of the tag is really obvious, I usually consult the help text of the tag:

About injection

inserting malicious content, usually code (like SQL, Javascript) into a vulnerable application

In this case the help text explicitly makes the tag appropriate for both SQL injection and XSS.

(When the help text is too vague, unclear, or even missing, I see which other questions use the tag and try to stay consistent with existing usage.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .