You're missing the more important vector for prompt injection: Indirect injection through the "search engine context". It's not just a matter of blocking bad user questions to fend off reputational harms. See also my work on https://kai-greshake.de/