Delimiters won’t save you from prompt injection