In my experience, it is much more likely someone forgets to escape some input and opens the database up (via SQL injection) than it is for someone to break in v

In my experience, it is much more likely someone forgets to escape some input and opens the database up (via SQL injection) than it is for someone to break in via ssh or gain access to the shell.