For sure. Or become a new entry point for sql injection. As it is conversational, maybe the combined attack could be called a "speak-ql injection".