I am trying to use REST API Query resource to execute SOQL query. From the documentation I see that query is passed as query parameter in the GET call. This will be used from the external system to connect to SFDC and sent the GET request to get the query result.
https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/dome_query.htm
I am trying to understand the security implications of this approach where SOQL query is passed as query parameter string without any bind variables etc. Risks around SOQL injection etc.
Can someone shed some light on this approach ?