Even worse, all outputs become inputs, at least in the most interesting use-cases. So to continue the SQL analogy, you can be 100% confident that in the legitim

Even worse, all outputs become inputs, at least in the most interesting use-cases. So to continue the SQL analogy, you can be 100% confident that in the legitimacy of: SELECT messages.content FROM messages WHERE id = 123; Yet the system is in danger anyway, because that cell happens to be a string of: DROP TABLE customers;-- ... Which becomes appended to the giant pile-of-inputs. _____ Long ago I encountered a predecessor's "web scripting language" product... it worked based on repeatedly evaluating a string and substituting the result, until it stopped mutating. Injection was its lifeblood, Even an if-else was really just a decision between one string to print and one string to discard. As much as it horrified me, in retrospect it was still marginally more secure than an LLM, because at least it had definite (if ultimately unworkable) rules for matching/escaping things, instead of statistical suggestions.