There are crucial differences between prompt and SQL injection which – if not considered – can undermine mitigations.