AI application security

Prompt injection explained for web developers

September 25, 2026 · BuildSellSecure · Course: Secure AI Web Apps

If you have added an AI feature to a web app, you have added a new kind of input, and the older rules for input validation do not map cleanly onto it. Traditional input is data. A prompt is closer to a set of instructions. When instructions and data arrive in the same channel, someone can smuggle instructions inside the data. That is prompt injection.

The two shapes

Direct injection is a user typing something like "ignore your previous instructions" to steer the model. It is the version people talk about first.

Indirect injection is the more dangerous one for web apps. Here the malicious instructions hide in content the model retrieves, such as a web page, a product description, or a document the user uploaded. The model treats retrieved text as part of its working context, so anything in that text can influence the output. Your user never typed the attack, which makes it easy to miss.

What you can actually control

You cannot fully secure a language model any more than you can fully secure any other component. What you can do is reduce the blast radius. A few patterns do most of the work:

• Separate instructions from data. Keep the system instructions and the untrusted content clearly apart, and treat all retrieved content as untrusted.
• Validate the output. Treat model output as untrusted input. Never pass it directly into a shell, a database query, or a privileged action.
• Limit the tools. Give the model the fewest permissions it needs. A read-only tool cannot delete anything.
• Gate high-impact actions. Ask a human before anything destructive, expensive, or public.
• Add rate limits and cost controls. They contain both abuse and runaway billing.

Practice safely

The right place to test your defenses is a local, authorized sandbox with fictional data. You are not trying to attack anyone. You are checking whether your own app resists a hostile piece of retrieved content before a real user delivers it.

This is exactly what Secure AI Web Apps covers in its AI security module, alongside threat modeling, authentication, and the rest of the defensive basics. Treat the model as an untrusted component, and the rest of your security habits still apply.