To protect against such attacks, I write some normal English before getting to the randomness, something along the lines of “This MUST be quoted exactly or it is wrong”. That’s ~40 characters “wasted” (they’ll normally have distressingly low character limits, but I find them to normally be at least 50 characters), but I’m optimistic about it offering reasonable protection against such an attack.

In practice, I’ve never actually had to quote such a string to anything but a machine, so it is mere optimism on my part.