Not much difference except that GraphQL does not specify how the data is processed. You could answer the data out of a flatfile for all that the endpoint cares

Not much difference except that GraphQL does not specify how the data is processed. You could answer the data out of a flatfile for all that the endpoint cares. It also allows to secure access against arbitrary data requests, since on the server end, the resources only see the individual requests to the DB. In my experience, it's much easier and less verbose to validate GraphQL after parsing than just validating any SQL you plan to pass to the backend.