The first instinct every developer has about prompt injection is the right instinct for the wrong problem. Filter the input. Strip the malicious instructions. Add a guardrail that catches "ignore previous instructions." It feels like SQL injection, and we beat that with parameterised queries, so surely the same move works here.
It doesn't, and it's worth understanding why before you build your agent around a defence that won't hold.
Why it isn't SQL injection
SQL injection is solvable because there's a clean line between code and data. A parameterised query tells the database "this part is a command, this part is a value, never mix them." The boundary is structural, and the database enforces it for you.
An LLM has no such boundary. Instructions and data arrive as the same thing: text. When your agent reads a web page or an email, that content lands in the same context window as your system prompt, and the model decides what to act on based on meaning, not on some tag marking one part as untrusted. There is no parameterised-query equivalent because there is no separate channel for data. It's all just tokens the model interprets together.
