Why is it safe to write GraphQL queries client-side?

Question

GraphQL was recently released, and it seems to encourage writing your queries client-side.

1. What is it that makes it safe to write GraphQL queries client-side, but not SQL queries?
2. Is GraphQL not subject to injections?
3. If it's so useful to have your queries client-side, why not make a version of SQL not subject to injections?

Answer 1

Since this wasn't answered by the users who answered it in the slack channel, I'll post their answers.

1. GraphQL queries are validated against a schema that was built explicitly to expose data to the client. SQL doesn't validate your query against anything other than the DB schema structure.
2. In theory your GraphQL endpoint has some sort of security in place to validate the user is allowed to query the data at the starting point of their query. Once they are inside the Graph based schema, permissions are inherent to the graphQL schema definition, and injection wouldn't accomplish anything.
3. Making a version of SQL that isn't subject to injection would involve some of the same validations that GraphQL does. Some sort of validation that all requested data/mutations are allowed. As quoted in the chat, "Injection isn't a problem inherent to SQL".

Answers credited to charlie and samwgoldman from the GraphQL/#general Slack chat.