SQL Injection

Prompt注入（Prompt Injection）是针对大语言模型应用的安全威胁，攻击者通过在输入中嵌入恶意指令试图覆盖系统原有行为约束

Prompt Injection is a security attack method targeting AI applications, analogous to SQL injection in traditional web development.

Prompt injection is essentially an architectural flaw in which large language models cannot distinguish data from instructions, analogous to traditional SQL injection in which the database engine confuses data with SQL instructions.

Vulnerabilities such as SQL injection, XSS, and SSRF have long occupied the OWASP Top 10 security risk list.

The principle of SQL injection is that an attacker inserts malicious SQL statement fragments into user input fields; when the backend directly concatenates user input into database query statements, it is executed by the database engine, leading to data leakage, authentication bypass, or even database write operations.

A WAF (Web Application Firewall) is a security device or software deployed in front of web servers that intercepts known attack patterns by inspecting the characteristics of HTTP requests.

Prompt injection is essentially an instruction hijacking attack that exploits the structural flaw of LLMs being unable to distinguish system instructions from user data at the semantic level, and is conceptually similar to SQL injection.

SQL injection can fundamentally isolate data from instructions through parameterized queries, whereas there is currently no equivalent "parameterized" solution for the LLM inference process.

Prompt injection shares a structural analogy with SQL injection vulnerabilities: the latter exploits a database's inability to distinguish SQL code from data strings, while the former exploits an LLM's inability to distinguish meta-instructions from the content being processed.

Large language models cannot reliably distinguish the boundary between system instructions and user/external content during inference—this is a fundamental limitation of prompt injection, similar in principle to SQL injection.

A database dump/data breach refers to an attacker gaining read and write access to a database through SQL injection, weak passwords, exploitation of known vulnerabilities, or other means, and exporting user tables.

Unlike traditional SQL injection, prompt injection has no strict syntactic boundaries, making defense harder and often requiring a combination of layered measures such as input filtering, instruction isolation and output validation.

Unlike SQL injection, prompt injection has no simple escaping or parameterization scheme, because there is no formal boundary between natural language instructions and data.

The UK National Cyber Security Centre (NCSC) points out that language models have no equivalent isolation mechanism, and prompt injection may never be completely fixed the way SQL injection has been.

Input validation is used to prevent attacks such as SQL injection and cross-site scripting (XSS), and the principle is to trust no data from the client side.

Building SQL queries with f-strings creates SQL injection risk; bound parameters or text(...).bindparams() should be used instead.

Similar to SQL injection, prompt injection exploits the system's confusion between 'input' and 'instruction', but the difference is that LLMs have no strict data/code separation mechanism, and all text shares the same semantic channel.

Prompt injection currently has no 'parameterization' fix like SQL parameterized queries, because the model is architecturally designed to receive system instructions, user input, and external content as the same set of tokens.

The term Prompt Injection entered the security research field around 2022 with the popularization of conversational models such as ChatGPT, and its naming borrows from SQL injection in traditional Web security.

If the tools exposed by an MCP server allow the model to pass in arbitrary SQL statements, this is essentially a SQL injection vulnerability with the LLM as the intermediary.