3 ms·
It isn't that simple. Input can be zipped or obfuscated and then missed by the escape logic. Also, the SQL injection protection from 25 years ago didn't escape
by gitfan86 4y ago
It isn't that simple. Input can be zipped or obfuscated and then missed by the escape logic. Also, the SQL injection protection from 25 years ago didn't escape UTF-16. There are pretty much daily CVEs related to SQL injection in 2023.
I understand that LLMs have a larger vector space of an attack surface, but those same technologies give the protection a large vector space as well to sandbox the output and detect anomalies.
- ceejayoz 4y ago> Input can be zipped or obfuscated and then missed by the escape logic. No. You can try posting a zipped/obfuscated email address to `SELECT * FROM users WHERE email=?`, it's not going to do anything (except not find a matching row). > the SQL injection protection from 25 years ago ... wasn't parameterized queries. The days of mysql_real_escape_string are gone. > There are pretty much daily CVEs related to SQL injection in 2023. Because people are still writing unparameterized queries. The solution exists, they just aren't using it. Legacy apps, shitty starter tutorials, etc. No such reliable solution exists for LLMs.
- gitfan86 4y agoMy first comment in the thread proved that you can add protection from prompt injection. If you are unhappy that it isn't perfect protection that is fine, but it still helps.