Injection is a single idea — user data is treated as code by an interpreter. The interpreter changes (SQL engine, shell, browser), the bug pattern is identical.
A search page echoes the query into the HTML without escaping. <script>
in the input becomes a real <script> in the rendered page.
return f"<p>You searched for: {q}</p>" # q never escaped
Type hello — your query is echoed back as text.
Type <script>alert('XSS')</script> — the browser
runs the script.