Testing Prompt Injection "Defenses": XML vs. Markdown, System vs. User Prompts