How would you protect against common security vulnerabilities, like SQL injection or DDoS attacks, in a GraphQL API?

To protect a GraphQL API against SQL injection, use parameterized queries or prepared statements in database operations, and rigorously validate and sanitize all user inputs. To defend against DDoS attacks, implement rate limiting, query complexity analysis, and depth limiting to control the load on your server. As an added measure, use monitoring systems and Web Application Firewalls (WAFs) to identify and address suspicious traffic or activities.