XML Tags in Prompts
PromptingDefinition
A Claude-native prompting pattern using XML-style tags (e.g., <document>, <instructions>, <example>) to clearly delimit sections of a prompt. Helps Claude unambiguously identify context, instructions, and data. Reduces prompt injection risk by separating instructions from untrusted input.
Example Usage
Wrap user-supplied content in <user_input> tags and instructions in <instructions> tags to prevent content from overriding your system prompt.
Why It Matters for the CCA-F Exam
The exam tests XML tags in two contexts: (1) prompt organization — using tags to improve clarity and caching efficiency of complex system prompts; and (2) security — recognizing that wrapping untrusted data in XML tags is a primary defense against prompt injection. Questions may present a system prompt that concatenates user-supplied text directly and ask you to identify the risk and the fix.
In Depth
XML tags are a Claude-native prompting pattern that uses angle-bracket delimiters — <instructions>, <document>, <examples>, <user_input> — to explicitly partition different sections of a prompt. Unlike natural-language prose that flows together, XML tags give Claude unambiguous structural cues about which part of the context is instruction, which is data, and which is example.
Why Claude responds well to XML structure. Claude was trained on a large volume of structured text including XML, HTML, and documentation formats. Using XML tags in prompts aligns with patterns the model has seen extensively, making section boundaries reliably detectable without requiring Claude to infer intent from indentation or phrasing alone.
Preventing prompt injection. The most security-critical use of XML tags is isolating untrusted content from instructions. When a system prompt pulls in external data — a web page, a user-submitted document, a database record — that content may itself contain text that looks like instructions. Wrapping it in a tag like <retrieved_document>…</retrieved_document> gives Claude a clear signal that content inside the tag is *data to be processed*, not *commands to be followed*. This substantially reduces the surface area for prompt injection attacks compared to concatenating content directly into the instruction text.
Practical tag vocabulary. There is no fixed standard; use descriptive names that mirror the role of the content. Common conventions include:
<context>or<background>— reference material<instructions>— the task to perform<examples>containing nested<example>blocks — few-shot demonstrations<user_input>or<query>— the untrusted end-user turn<thinking>— a scratchpad for chain-of-thought reasoning<output>or<answer>— the final response delimiter
Parsing structured XML output. You can also ask Claude to *respond* using XML tags to make extraction deterministic: "Wrap your classification in <label> and your confidence in <confidence>." This is lighter-weight than full structured output via a tool schema and works well when you need two or three fields rather than a deeply nested JSON object.
Limits. XML tags structure the prompt but do not cryptographically bind content. A sufficiently crafted injection payload could still attempt to close an outer tag and introduce a sibling instruction block. For high-risk pipelines handling adversarial inputs, combine XML tagging with input sanitization and consider structured output via tool-forcing as a stronger guarantee on the response shape. The Prompt Specificity & Precision guide covers how tag structure interacts with instruction clarity.
Frequently Asked Questions
Are there specific XML tag names Claude is trained to recognize?
No fixed vocabulary is enforced. Claude responds to descriptive tag names by inferring their role from the name and context. Consistency matters more than specific names — if you use `<user_input>` in your examples, use it consistently throughout the prompt.
Can XML tags fully prevent prompt injection?
They substantially reduce the risk by separating data from instructions, but they are not a cryptographic guarantee. Sophisticated injection payloads may attempt to close outer tags or use nested structures. For high-risk workloads, combine XML tagging with input sanitization and consider a tool-based schema for the response to eliminate free-form instruction-following entirely.
Should I use XML tags or markdown headers (##) to structure system prompts?
Either works, but XML tags are generally more reliable because they create unambiguous boundaries that cannot be accidentally broken by the model's tendency to reformat markdown. XML tags also compose cleanly with nested content — a `<context>` tag can contain markdown inside it without structural ambiguity.