Another excellent reason for the frontend to access the database using packaged procedures, instead of through direct SQL access.

Using packaged procedures that accept values to be bound to ref cursors gives you automatic protection against SQL injection.