The hardest injection is not the one the user typed. It is the one that arrives inside a document the system fetched, because it passes every review a person could do.
About 1 min of reading
Prove a fetched page cannot instruct
Write a page that contains an instruction
Before you run it, say out loud what it will print. Then open the answer.
Put it in the data channel only
Before you run it, say out loud what it will print. Then open the answer.
Require the citation
Before you run it, say out loud what it will print. Then open the answer.
Before you write anything, put these lines back in the right order. Click a line to move it up one step. This support step is easier than writing code from scratch, and it is here to make the last example stick.
An answer with a citation can be checked. An answer with no citation cannot be traced to anything, which is the point of the rule.
Retrieved text never becomes part of the instruction. If it is only ever part of the data, the instruction channel has no door.
Nobody reads a fetched page before it is used. Anything written on that page reaches the model unexamined.
The fence stops the user from closing it. It does not stop the fetched text from containing an instruction inside the fence.
Retrieved text is quoted, not merged. A quote with a source is data the model can name but cannot obey.
Each one is defined here on this site. Open the entry for the full definition and the other words it points at.