One of the most ignored features of the modern RDBMSs today is the stored procedures. In fact most of the web applications go to extreme lengths to increase performance but avoid the stored procedures. They are also one of the favorites in theory, but hated in practice. [Continue]
SQL Injection is probably the best reason, other than speed of execution sometimes, to use stored procedures instead of dynamic SQL queries. Ill-intentioned users can inject character literals through their input that can be used to comment out part of the query being executed. Scott Glu has a tip on ways of preventing it (via Miguel de Icaza). [Continue]