ISVforce Guide
jNewer Version Available
Validate User-Controlled Data Added to a Prompt
Before including user-controlled data in a prompt, validate the data. Ensure it meets
criteria for an acceptable input based on your use case. If the criteria isn't met, don’t
include the data in the prompt.
Common criteria include:
- An allowlist of characters or words that are acceptable as input, such as the use of zero-width characters. This reduces the likelihood of a prompt injection exploit. Promptfoo's guide to jailbreaking LLMs has examples of prompt injection permutations using different characters and formatting.
- Length limitations. This helps limit the effectiveness of Do Anything Now or virtualization attacks.