Prompt injection is not SQL injection (it may be worse)