Comment on Ask HN: How to Safeguard a LLM to SQL Prompt from SQL Injection?Comments−laxk1yDB Level:- Create SQL credentials for LLM queries that will have limited access (exclude sensitive fields, tables, views etc) and read-only access.- Use SQL views to avoid/exclude access to specific fields.App Level:- Use SQL linters and treat input as a regular user input.- Convert the SQL query string into a query tree, escape ALL fields and then assemble the query back.
Comments
DB Level:
- Create SQL credentials for LLM queries that will have limited access (exclude sensitive fields, tables, views etc) and read-only access.
- Use SQL views to avoid/exclude access to specific fields.
App Level:
- Use SQL linters and treat input as a regular user input.
- Convert the SQL query string into a query tree, escape ALL fields and then assemble the query back.