Data is injected from application into query

The data is used to dynamically construct a SQL query

when sql query is executed injected application code from the database.

None of these