Text-to-SQL is a workflow that converts a natural-language request, such as “show last quarter’s revenue by region,” into a SQL query that can be run against a database. It is used to make data access easier for non-specialists and to speed up analytics, support dashboards, and internal reporting.
In security terms, Text-to-SQL is risky because the model must map human intent to exact database operations. Small errors can create wrong joins, expose sensitive columns, or generate expensive queries that stress production systems. Attackers may also try prompt injection or ask for data outside their role. Common defenses include a semantic layer, strict schema and table allowlists, query validation, parameterization, row-level access controls, and human approval for high-impact queries. In mature systems, the model suggests a query, but deterministic code decides whether it can run.