这篇论文用具体数据告诉你，Handlebars的{{}}和{{{}}}差别有多大，以及为什么别指望HTML转义防注入。
该论文分析了Handlebars模板引擎中双花括号{{x}}和三角花括号{{{x}}}对LLM提示注入的影响。双花括号HTML转义尖括号但不转义方括号、冒号或Markdown井号，导致ChatML、Llama-3和XML分隔符存活率为0.00，而Llama-2 [INST]、Human:/Assistant:和Markdown ###分隔符存活率为1.00。在5760次试验中，GPT-3.5 Turbo在原始插值下任务劫持成功率达97%，在转义下为91%。Claude Haiku 4.5几乎完全抵抗两种攻击。转义默认值仅对HTML转义覆盖的分隔符方案有效，无法替代指令与数据的结构化分离。
Structural Role Injection in Handlebars-Templated LLM Prompts: Triple-Brace Interpolation, Delimiter Family, and the Limits of HTML Auto-Escaping
Large language model applications build prompts from templates, and Handlebars is a widely used templating engine and the default prompt-template format in Microsoft Semantic Kernel. Its double-brace {x} expression HTML-escapes the interpolated value and is documented as the safe default; its triple-brace {x} expression inserts the value raw. We show that this choice silently governs an application's exposure to structural role injection, where attacker-controlled data carries chat role delimiters that forge a higher-privilege turn. A model-free analysis establishes the mechanism: Handlebars escaping rewrites angle brackets but not square brackets, colons, or Markdown hashes, so it neutralises ChatML, Llama-3, and XML role delimiters (survival rate 0.00) while leaving Llama-2 [INST], legacy Human:/Assistant:, and Markdown ### delimiters intact (survival rate 1.00 for the last two). We then run 5760 trials across seven delimiter families, two attack objectives, and four models (GPT-3.5 Turbo, GPT-4o mini, GPT-4.1 mini, Claude Haiku 4.5) at a combined API cost of 1.63 USD. GPT-3.5 Turbo follows the task-hijack instruction in 97% of raw and 91% of escaped trials, with the escaping protection concentrated in the angle-bracket families and absent for the colon- and Markdown-based families; the harder secret-exfiltration objective, which does not saturate, exposes the same family interaction more cleanly. Claude Haiku 4.5 resists both objectives almost entirely. The escaped default protects only the delimiter schemes whose characters HTML escaping happens to cover, gives no protection for the rest, and cannot substitute for a structural separation of instruction and data.