Curious Pondering - MYSQL And How It's Always Eventually Evaluated As A String

I was working recently on building an abstraction for IndexedDB in Javascript and as I was building I was thinking ahead about building queries. I have only just begun using the feature and so I haven't really delved into retrieving data as it refers to searching. Regardless, I was thinking about building a simple SQL type language. This is really impractical of course but, the thought crossed my mind for a second. It passed quickly mainly because I would be evaluating a string and accessing a database. Particularly in Javascript this could be a terrible disaster as any script kiddie could inject a string and it would be evaluated to a database. Albeit a local database on their computer. 

But, it got me to thinking...In reality in PHP even when using object based queries the query is converted to a string and is evaluated by the MYSQL server.

I know because it's possible to dump the queries in the MYSQL settings.

This seems like a slight vulnerability. It also seems like an extra abstraction. Object to String then String to ... Object ... then Object to Machine Code??? ... I think?

I know that it's a good idea to NOT have many databases in MYSQL because even if you are not using them each DB is converted to an object in memory when MYSQL is started so, it seems like the query must also be evaluated to an object before being interpreted.

I am curious if object based queries in SQL Server when used in a .NET environment are also converted to a string? 

I am probably off base on this. If it is actually an issue I am sure that the guys who build this stuff on the metal are aware of it. Maybe it's just something legacy that is just not enough if an issue to resolve.