SQL Injection would be straightforward if scripting code was not properly sanitizing its inputs.
Here is a good post on SQL Injection Prevention via Stored Procedures : Do stored procedures prevent SQL injection?
Interestingly, even in the book MySQL 5.0 Certification Study Guide, Chapter 33 is all about using Stored Procedures and Triggers for Administration. In it are three bulletpoints on Page 470:
For the tables in question, disallow direct access to by ordinary
users for INSERT, UPDATE, and DELETE statements. (You can do this be
granting the appropriate privileges to administrative users only.)
Implement a procedural interface for modifying each table. That is,
using an administrative account that has access to the table, write
stored procedure that have DEFINER security and that perform the
required modifications to the table, giving appropriate data values as
parameters. Grant the EXECUTE privilege for these routines to the
Require users to perform table modifications by calling the stored
procedures and passing column values for the rows to be modified as
parameters. Each procedure examines its arguments and verifies that
they satisfy whatever constraints are deemed necessary. If the
arguments are suitable, the procedure performs the requested
modification. If they are not, the procedure aborts the operation.
In another mysql aspect, you have to secure user authentication. The most overlooked aspect is looking for the mysql schema tables. I wrote about this before in terms of how user authentication works and how to clean it up at install time and later afterwards: