Reflection is an API built into the Java language. Reflection allows you to target a jar file (in this case the runescape game) and read (at run-time) the variables stored within. Reflection is non-invasive, meaning it doesn't edit or change the client in any way. If done properly, reflection should be undetectable. I mean, there's always a way, they could always just scan for changes in access specifiers for certain variables, but they currently don't.
Injection works on the same variables as reflection, except that instead of "looking" at their variables at runtime, accessor methods are injected into the client before it is run and then you run a modified client that inherits the interfaces of your bot and contains methods to receive the value of certain fields from within the bot. Injection used to be fairly safe, now adays I wouldn't get anywhere near it.
EDIT:
Some readings for anyone interested in learning more:
Reflection API:
http://docs.oracle.com/javase/tutorial/reflect/A tutorial I wrote ages ago as an introduction to accessor methods (injection) and client hacking:
https://www.moparscape.org/smf/index.php/topic,293125.0.htmlAnother one similar to the above, also written by me:
https://www.moparscape.org/smf/index.php/topic,293071.0.html