Actually, the bits of SQL everywhere is the #1 problem with the code. We spent weeks just auditing them all to remove SQL injection vulnerabilities. All the SQL are fragile bits of code, difficult to write meaningful unit tests for, since you can't separate database interaction from logic, etc.

Been there too, which is why I like stored procedures now (testability, clean code, predictability).