Prompt injection has no parameterized-query fix because an LLM has no separate channel for instructions and data.
SQL injection was fixed because databases separate code from data. A prepared statement sends the query shape first and values after, so a value never becomes syntax.
An LLM has no such split. System prompt, user text, and retrieved documents arrive as one token sequence. Instructions are recognized by meaning, not position.
# SQL: the driver enforces the boundary
cur.execute("SELECT * FROM docs WHERE id = %s", (user_input,))
# LLM: the "boundary" is just more text
prompt = f"{system}\n\nDocument:\n{untrusted_doc}"
So defenses move outward: limit tools, permissions, and blast radius.
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
Why there's no diagram: “”
The interactive diagram is below the answer - jump to diagram ↓ · Below it, the related concept . Jump to it ↓
The diagram below the answer is the concept . Jump to it ↓