HTML injection, also known as HTML code injection or client-side code injection, is a web attack technique that allows an attacker to inject malicious HTML code into a vulnerable web application. This type of attack occurs when user-supplied input is not properly validated or sanitized by the application before being included in the HTML response.