# From Prompt Injections to SQL Injection Attacks: How Protected is Your LLM-Integrated Web Application?

**Authors:** Rodrigo Pedro, Daniel Castro, Paulo Carreira, Nuno Santos  
**arXiv:** [2308.01990](https://arxiv.org/abs/2308.01990)  
**Date:** 2023-08-03  
**Summary page:** https://www.summarizepaper.com/en/paper/2308.01990v3/

## Key points

- Large Language Models (LLMs) are popular in various domains, including web applications with chatbots.
- LLMs used in web applications can introduce security vulnerabilities, specifically prompt injection attacks.
- Prompt injection attacks occur when unsanitized user prompts are translated into SQL queries, leading to SQL injection and compromising database security.
- Limited research has been done on the risks associated with generating SQL injection attacks through prompt injections.
- The authors present a comprehensive examination of prompt-to-SQL (P$_2$SQL) injections targeting web applications using the Langchain framework.
- Different variants of P$_2$SQL injections are explored and their impact on application security is assessed through multiple examples.
- Seven state-of-the-art LLMs are evaluated to demonstrate the prevalence of P$_2$SQL attacks across different language models.
- Langchain-integrated applications are highly susceptible to P$_2$SQL injection attacks.
- Four effective defense techniques are proposed: database permission hardening, SQL query rewriting, auxiliary LLM-based validation, and in-prompt data preloading.
- These defenses are validated through an experimental evaluation with a real-world use case application.
- The paper addresses three main research questions regarding P$_2$SQL injections and their impact on application security, the effectiveness of P$_2$SQL attacks depending on the adopted LLM, and effective defenses against P$_2$SQL attacks for application developers.

## Summary

Large Language Models (LLMs) have become increasingly popular in various domains, including web applications, where they enable human interaction through chatbots with natural language interfaces. However, the use of LLMs in these applications can also introduce security vulnerabilities, particularly when it comes to prompt injection attacks. Prompt injection attacks occur when unsanitized user prompts are translated into SQL queries used by the LLM to provide responses. These attacks can lead to SQL injection, compromising the security of the underlying database. Despite the growing interest in prompt injection vulnerabilities targeting LLMs, there has been limited research on the specific risks associated with generating SQL injection attacks through prompt injections. In this paper, the authors present a comprehensive examination of prompt-to-SQL (P$_2$SQL) injections targeting web applications based on the Langchain framework. They explore different variants of P$_2$SQL injections and assess their impact on application security through multiple concrete examples. Additionally, they evaluate seven state-of-the-art LLMs to demonstrate how pervasive P$_2$SQL attacks are across different language models. The findings indicate that LLM-integrated applications using Langchain are highly susceptible to P$_2$SQL injection attacks. To counter these attacks, the authors propose four effective defense techniques that can be integrated as extensions to the Langchain framework. These defenses are validated through an experimental evaluation with a real-world use case application. The paper addresses three main research questions: What are the possible variants of P$_2$SQL injections and their impact on application security? To what extent does the effectiveness of P$_2$SQL attacks depend on the adopted LLM in a web application? What defenses can effectively prevent P$_2$SQL attacks with reasonable effort for application developers? Through their analysis, they discover that even with unmodified versions of Langchain middleware, attackers can easily inject arbitrary SQL queries and gain unauthorized access to the database. They also find that the identified P$_2$SQL attacks can be launched across all surveyed LLM technologies capable of generating well-formed SQL queries. To mitigate these attacks, the authors propose four defense techniques: database permission hardening, SQL query rewriting, auxiliary LLM-based validation, and in-prompt data preloading. Preliminary results with a use case application show that these defenses are effective and can be implemented with acceptable performance overhead. Overall, this paper provides the first comprehensive study of P$_2$SQL injections targeting web applications based on Langchain and demonstrates the need for robust defenses against these attacks.