As a work-around for the various problems specified above - difficulty of code maintenance, version control, error-finding, you have this slightly "klugey" possibility:
Create functions (name them carefully, according to what they do) in some file that's always included - if you have a custom module you're writing for the site, that's a great place to put these functions. The php you enter then is simply: return my_specialfunc($somevar);
- $somevar
here potentially being the node object worked on, or whatever other variables are relevant here.
I find that I still usually want the flexibility, in some places, of calling my own code. In using this technique, maintaining the code is easy since it's simply a matter of modifying the function in the file. Error-spotting is easy since the function will show up in a backtrace.
Notice, however, that this doesn't solve the potential security issues. These are largely dependent upon the security of the Drupal core. In general, database-contained code is often an achillees' heel of security - functionalities using database-contained code tend to be much more prone to exploitation, and security around them needs to be extra-tight. However, Drupal has in general been quite good at maintaining security for these issues - they have arisen and then quickly patched / solved with new releases.