Methods and systems for preventing code injection attacks are disclosed. Embodiments include generating a random security tag and obtaining an instruction block comprising an instruction to be executed by a processor. The instruction block includes at least one no-operation (NOP) instruction at a specified location within the instruction block. A first exclusive OR with the random security tag is applied to at least one instruction at the specified location, the instruction block is stored, and fetched for passing to the processor. Prior to passing the instruction block to the processor, the instruction at the specified location is verified by applying a second exclusive OR to determine whether the instruction at the specified location is the NOP instruction. When a NOP instruction, the instruction block is passed to the processor. When not an NOP instruction, the passing the instruction block to the processor is omitted.