Comment by hoppp

Maybe treat prompts like it was SQL strings, they need to be sanitized and preferably never exposed to external dynamic user input