Prompt-to-SQL Injections in LLM-Integrated Web Applications: Risks and Defenses

Abstract

Large Language Models (LLMs) have found widespread applications in various domains, including web applications with chatbot interfaces. Aided by an LLM-integration middleware such as LangChain, user prompts are translated into SQL queries used by the LLM to provide meaningful responses to users. However, unsanitized user prompts can lead to SQL injection attacks, potentially compromising the security of the database. In this paper, we present a comprehensive examination of prompt-to-SQL ($\mathbf{P}_{2} \mathbf{S Q L}$) injections targeting web applications based on frameworks such as LangChain and LlamaIndex. We characterize$\mathrm{P}_{2} \text{SQL}$injections, exploring their variants and impact on application security through multiple concrete examples. We evaluate seven state-of-the-art LLMs, demonstrating the risks of$P_{2}$SQL attacks across language models. By employing both manual and automated methods, we discovered$\mathrm{P}_{2} \text{SQL}$vulnerabilities in five real-world applications. Our findings indicate that LLMintegrated applications are highly susceptible to$\mathrm{P}_{2} \text{SQL}$injection attacks, warranting the adoption of robust defenses. To counter these attacks, we propose four effective defense techniques that can be integrated as extensions to the LangChain framework.