Prompt injection cannot be reliably prevented by rewording a system prompt or adding one filter. Build AI applications so untrusted instructions cannot grant the model new authority: isolate external content, enforce permissions in application code, validate every tool call, and require approval before consequential actions.
What prompt injection is—and what the SQL injection comparison gets right
Prompt injection is an attack in which crafted language influences an AI model’s response or the actions of an application connected to it. An attacker may try to override an application’s instructions, expose information the model can access, or induce a tool to do something the user did not authorize. The risk depends not only on what the model says, but also on what information and capabilities the surrounding application gives it. OWASP’s LLM01 guidance describes the attack and its potential impact.
As an Amazon Associate I earn from qualifying purchases.
The SQL injection comparison is useful as a warning about mixing attacker-controlled input with a powerful interpreter: in both cases, an application can let hostile input influence behavior in ways its designers did not intend. But prompt injection is not SQL injection in a new syntax. Natural-language instructions can be ambiguous, arrive inside material the application retrieves or reads, and influence a model probabilistically. Traditional SQL parameterization remains important whenever generated or user-provided values reach a database, but it does not stop a model from being manipulated into choosing an unauthorized action.
Recommended Free Tools
OWASP’s LLM01:2025 page says there is “no fool-proof prevention within the LLM.” The practical goal is therefore to reduce the chance of successful attacks and, more importantly, limit the damage if the model follows hostile instructions.
#1 Best Overall
How direct and indirect attacks reach an AI application
Direct injection comes from the user
A user can place hostile instructions in a message, asking the model to disregard its usual role, reveal information, or misuse an available capability. This is the more visible path because the attack is part of the submitted prompt. It still needs to be treated as a security concern when the application connects the conversation to private data or tools.
Indirect injection arrives inside material the model processes
An attacker can place instructions in a webpage, document, file, image, or other external material that an application later retrieves or supplies to the model. The user may ask for an ordinary summary, while the retrieved content attempts to redirect the model or trigger a connected action. Microsoft’s guidance on indirect prompt injection discusses this attack path.
In both cases, the important question is what authority the model interaction has. If it can access sensitive records or invoke tools that send, change, or delete data, a manipulated response can become an application security incident rather than merely an inaccurate answer.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesBuild controls at the boundaries where authority exists
Use layered controls around the model. Labels and instructions can help organize context, but they are not substitutes for access control enforced by application code. The OWASP LLM01 guidance and Microsoft’s indirect-injection guidance both support treating this as a system-design problem, not a prompt-only problem.
1. Keep untrusted content separate from trusted instructions
Treat user messages, retrieved documents, webpages, files, tool results, and model-generated text as untrusted input. Preserve their source and mark them clearly when assembling context so the application and model can distinguish external material from task instructions. Do not let a document’s appearance, formatting, or claims of authority turn it into an instruction source.
Source labels and delimiters can make context easier to interpret, but they do not enforce permissions. If a retrieved document contains information a user is not allowed to see, do not rely on the model to ignore it: filter access in the retrieval or application layer before that content reaches the model.
Rank #3
2. Give tools only the authority needed for the task
Keep authorization checks outside the model. Before executing a tool call, application code should determine whether the current user is allowed to perform that operation on the specified resource. Give tools narrow scopes, use identities tied to the user or task where appropriate, and avoid long-lived or broadly privileged credentials. A model’s assertion that a user is authorized is not an authorization check.
Prefer narrow operations over general-purpose capabilities. For example, a tool that can retrieve one permitted record for a specific task exposes less authority than a tool that can query an entire database. Limit what each tool can read or change, and avoid giving a model access to secrets or operations that the task does not require.
3. Validate every tool call and its arguments
Treat a model-generated tool request as an untrusted proposal, not a command. Validate its schema, types, ranges, identifiers, and permitted operation in application code. Then recheck authorization against the actual user, resource, and action at execution time. Reject unexpected arguments and requests outside the tool’s narrow purpose rather than asking the model whether they are safe.
For any action that changes external state, make the boundary explicit: validate the proposed action first, check permission next, and only then execute it—or pause for approval when the action is consequential.
4. Put action-specific human approval before consequential side effects
Require confirmation before operations such as sending or deleting data when an erroneous or manipulated action could cause harm. Show the user the exact pending action and its relevant arguments—such as the recipient and message for a send operation—so approval applies to what will actually happen. A vague confirmation to “continue” is less useful if the model can change the action after the user approves.
5. Secure outputs for their destination
Model output is untrusted when it flows into another system. Apply the security controls appropriate to that destination: safely render text in HTML, use parameterized database operations for SQL values, and do not treat generated text as safe shell syntax or trusted commands. Parameterization addresses SQL interpretation; it does not decide whether the model should be allowed to perform the underlying operation.
Best Value
Keyword filters on generated text are not a dependable substitute for these controls. A response can be harmful without using a known suspicious phrase, and a filter cannot enforce the user’s permissions or reliably determine whether a proposed side effect is authorized.
6. Monitor decisions and plan for containment
Log security-relevant events such as tool requests, authorization outcomes, validation failures, approval decisions, and executions. Keep logs useful for investigation while avoiding unnecessary retention of secrets or sensitive prompt content. Monitor for anomalous or repeated denied actions, and make it possible to revoke credentials, disable a tool, or otherwise contain a problem without relying on the model to cooperate.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A practical request-to-action flow
A secure flow keeps the model in a proposing role while the application retains authority over access and execution:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Establish the user and task. The application determines the authenticated user and the resources that user may access.
- Retrieve only authorized material. Apply access checks before supplying documents or records to the model; label external content as untrusted context.
- Ask the model for a response or proposed tool call. Do not grant authority merely because the model requests an operation.
- Validate the proposal in application code. Check the operation, arguments, resource scope, and user authorization. Reject anything invalid or out of scope.
- Pause for specific approval if needed. Show the user the actual pending action and relevant arguments before a consequential side effect.
- Execute with limited authority and record the outcome. Use only the permissions needed for the approved operation, then log the security-relevant decision.
- Handle the result safely. Treat tool results and model-generated content as untrusted when they return to the conversation or flow into another system.
Test the attack paths your application actually has
Testing only obvious malicious user prompts misses indirect attacks and downstream weaknesses. Exercise the real input channels, retrieval paths, tools, and output destinations in the application, including the permissions used in those paths.
- Direct-input cases: Try user messages that request disclosure of restricted data or ask the model to invoke a tool outside the task.
- Indirect-content cases: Put hostile instructions in representative webpages, files, retrieved documents, and tool results, then test whether they can redirect the response or a connected action.
- Authorization cases: Request an otherwise valid operation against a resource the user should not access. Confirm that application code denies it regardless of what the model says.
- Argument cases: Try malformed, unexpected, or out-of-scope tool arguments and confirm that validation prevents execution.
- Approval cases: Check that sensitive actions pause, that the user can inspect the specific action, and that a changed action requires the appropriate approval.
- Output cases: Check that generated content is handled safely in each destination, including HTML and database operations.
- Containment cases: Verify that operators can revoke or narrow access and disable a problematic tool, and that logs support investigation without retaining unnecessary sensitive content.
Repeat these checks when prompts, tools, retrieval sources, permissions, or model-facing workflows change. Passing a set of tests is evidence about those tested paths, not proof that prompt injection is impossible. OWASP and Microsoft recommend layered defenses; neither a prompt instruction nor a single filter should be treated as a complete solution.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
