Automatic and Universal Prompt Injection Attacks against Large Language Models