> Prompt injection is not SQL injection (it may be worse)

There are crucial differences between prompt and SQL injection which – if not considered – can undermine mitigations.