OWASP Adds String-Metric Library Guidance to Prompt-Injection Cheat Sheet

According to the merged GitHub pull request #2134 in the OWASP/CheatSheetSeries repository (merged Apr 28, 2026), contributor 0xBassia added 8 lines to the LLM prompt-injection prevention cheat sheet. The PR inserts a short paragraph after the PromptInjectionFilter example in cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.md that points readers toward established string-metric approaches rather than the cheat sheet's minimal _is_similar_word helper. The PR discussion on GitHub includes the comment, "we shouldn't just go inventing our own as others are likely to be more complete," and a suggestion to "briefly list these common approaches (Levenshtein, Hamming, Jaro-Winkler, etc.) with a short note on their pros/cons," which the PR implements.

The change is limited to one file and adds an architectural guidance paragraph rather than replacement code, per the PR description. The added paragraph names specific algorithms and ecosystem library names and points to an external reference for deeper reading, while preserving the original example code as an instructional snippet. The PR notes that npm run lint-markdown and npm run lint-terminology passed cleanly in the contributor workflow, according to the GitHub status in the thread.

Pointing readers to established string-metric libraries helps practitioners avoid ad-hoc similarity functions when building prompt-injection filters, because algorithmic choices produce materially different false-positive and false-negative profiles. Industry patterns show common tradeoffs: edit-distance measures such as Levenshtein and Damerau-Levenshtein tolerate typos and transpositions, Jaro-Winkler is often better for shorter name-like tokens, and phonetic methods like Soundex and Metaphone address spoken-name variants but carry locale-specific limitations.

For practitioners implementing input filtering, monitor how projects benchmark these algorithms on realistic prompt-injection examples and language locales. Observers will also watch for follow-up PRs that convert guidance into recommended libraries or test suites across language ecosystems.