Injection attacks occur when an attacker exploits a vulnerability in an application by sending untrusted data as part of a command or query. This can include SQL injection, command injection, and script injection. Effective security measures include input validation, parameterized queries, and proper error handling.