Prompt Injection Isn’t a Bug. It’s a Property
If you worked on web applications fifteen or twenty years ago, you remember SQL injection. You'd be doing a code review, spot a line where the user's input was being concatenated straight into a SQL query, and feel a small chill. You knew what could happen next. You'd file a bug, talk to the developer, and replace the concatenation with a parameterized query.
Over time, the industry made SQL injection hard to get wrong. Frameworks handled queries for you. ORMs treated raw SQL as a thing to avoi…