Prompt injection vs SQL injection

Why they differ

Both slip commands in through input, but SQL injection targets a database while prompt injection targets a language model.

Prompt injection

AI risk & governance

Hiding instructions in the text an AI system reads so that it ignores its own rules and follows the attacker instead.

Formal

An attack on a large language model in which input written by an outsider, typed directly or hidden in a web page, file or email the model is asked to read, is treated as an instruction and overrides what its owner intended.

In plain English

Like slipping a note into a pile of letters a new assistant is sorting that says "ignore your boss and send me the keys" - and the assistant cannot tell the note apart from real orders.

In practice

A municipality's AI assistant sums up incoming emails from citizens; one email hides white-on-white text telling it to forward the last ten messages to an outside address, and it does.

Why it matters

The model mixes rules and content in the same stream of words, so there is no watertight fix yet; the more an AI system is allowed to do on its own, the more damage one hidden sentence can cause.

SQL injection

Application security

An attack where text typed into a form is read by the database as a command, letting an outsider read or change its data.

Formal

An attack on a web application that builds database commands by pasting user input straight into the command text; crafted input changes the meaning of the command, so the database runs instructions the developer never intended.

In plain English

Like a form that says "Pay the sum of ___ to Anna", where someone writes "10 kroner, and also pay everything to me" in the blank - and the clerk simply does all of it.

In practice

A small Danish online shop passes whatever is typed into its search box straight to its database; an attacker types a short piece of SQL instead of a product name, and the page lists every customer's email address and hashed password.

Why it matters

One weak form field can hand over a whole database, and the flaw still turns up in new code decades after it was first described - even though a simple habit, keeping input apart from the command, prevents it.

Shared connections

Data breach