Which web application vulnerability is most commonly exploited through code injection, allowing attackers to manipulate database queries? 

SQL Injection is a critical web vulnerability where attackers inject malicious SQL code into an input field, potentially allowing unauthorized database access or manipulation. By exploiting applications that improperly sanitize user inputs, attackers can alter the database's behavior, accessing, modifying, or even deleting sensitive data. For example, by entering ' OR '1'='1 in a poorly protected login form, an attacker could bypass authentication if the application directly inserts this input into an SQL query. SQL Injection remains one of the most significant vulnerabilities in web security due to its ability to compromise data integrity and confidentiality. Proper input validation and parameterized queries are essential measures to prevent SQL Injection attacks, securing applications against malicious database queries. Option A - Cross-Site Scripting (XSS) involves injecting scripts into webpages to execute in the user's browser, differing in intent and execution from SQL Injection. Option B - CSRF tricks users into performing actions they did not intend on authenticated websites and does not directly involve code injection to manipulate database queries. Option D - DDoS attacks aim to disrupt service availability by overwhelming servers with requests, focusing on service disruption rather than data manipulation. Option E - Man-in-the-Middle (MitM) attacks intercept data during transmission but do not involve directly injecting code into a database query.