Prompt Injection Escaper
Escape and wrap untrusted text before embedding it in an LLM prompt, and flag common injection keywords, to reduce prompt injection risk. This is a mitigation, not a complete defense.
FreeOnline Tool
Loading…
How to Use
- Paste the untrusted user text you intend to embed in an LLM prompt into the input box
- Choose a wrapping style: XML tags (such as <user_input>...</user_input>), a Markdown triple-backtick code block, or a custom delimiter
- Click "Process". The tool escapes characters that could be used to forge the delimiter or tag, wraps the content in the chosen style, and shows text ready to drop into your prompt
- The "Risk keyword hints" section below lists common Chinese and English injection or jailbreak trigger phrases found in the input (for example "ignore previous instructions", "you are now", "pretend to be", "system:"). This is a heuristic hint only, not an accurate verdict
- Click "Load sample input" to see a passage containing typical injection attempts and how the tool handles it
- The processed result can be copied with one click
Features
- Three wrapping templates: XML tags, a Markdown triple-backtick code block, or a custom delimiter
- XML wrapping escapes the content to HTML entities first, so a user cannot slip in a forged </user_input> tag to escape the wrapper
- Markdown wrapping counts the longest run of backticks already present in the content and lengthens the fence accordingly, so backticks inside the text cannot close the code block early
- Custom-delimiter wrapping breaks up any substring in the content that exactly matches your delimiter by inserting zero-width characters, so it can no longer be picked up by simple string matching
- Includes a built-in list of common Chinese and English injection and jailbreak phrases (such as "ignore all previous instructions", "you are now", "pretend to be", "system:", "forget your instructions") and scans the input heuristically, highlighting any hits
Use Cases
Wrapping user queries in a RAG system
Escape and wrap the raw user query before concatenating it into the system prompt, reducing the risk of forged instructions hidden in the query.
Protecting support and translation assistants
Support bots and translation tools can wrap third-party text pasted by users, which may contain malicious instructions, before handing it to the model.
Quick self-check while developing prompts
While building a prompt template, use sample data to see whether your delimiters can be broken by the content itself, catching the flaw before it ships.
Security awareness demos
Show a team what typical prompt injection triggers look like, and which attacks escaping and wrapping can and cannot stop.
FAQ
Does this tool prevent prompt injection completely?
No. It is only a risk-reduction aid based on escaping and wrapping. It does not replace model-side safety design (instruction hierarchy, output validation) or your own application-level input validation, and it cannot defend against every form of injection — especially cases where the model itself interprets the wrapper structure inconsistently.
What if the keyword scan misses something or flags normal text?
The keyword check is heuristic string matching against a list of common Chinese and English trigger phrases, not semantic understanding. It can miss a rephrased injection attempt and can also flag legitimate text (a normal discussion of "how to stop an AI from being told to pretend" will hit the word "pretend"). Treat the result as a hint and apply human judgment.
Which wrapping style should I pick?
XML tags have the broadest compatibility and suit most cases. The Markdown code block fits prompts that are already written in Markdown. A custom delimiter is best when you already have a prompt template convention you want to stay consistent with.
Does escaping distort the original meaning of the user's text?
In XML mode, characters such as <, > and & become HTML entities, and models generally still read the meaning correctly. If your downstream pipeline needs the raw characters back, you must unescape them yourself after receiving the model output.