3 ms·
SQL injections are preventable by either 1) escaping input (so that your query and the input continue to come in a single stream), or 2) sending the query out-o
by nextaccountic 4y ago
SQL injections are preventable by either 1) escaping input (so that your query and the input continue to come in a single stream), or 2) sending the query out-of-band, using prepared statements with placeholders
Converting this situation to AI, perhaps 2) can be done with https://github.com/openai/openai-python/blob/main/chatml.md https://github.com/openai/openai-python/blob/main/chatml.md, but if you were stuck with an unstructured text input and had to do 1), how would you escape the untrusted user input?
- layer8 4y agoYou can explain quoting syntax to ChatGPT, and it seems to understand data formats like JSON, so I assume that that should work.
- nextaccountic 4y agoIf you do the quoting inside a ChatGPT prompt then it will itself be hijacked with prompt injection
- actually_a_dog 4y agoYeah. This makes perfect sense if you consider it to be an interpreter for natural language that has a really good macro facility.