What I think is odd is the apparent SO hate on #1. That sounds like a good idea to me - to better understand what SQL injection is and how to find and plug vulnerabilities, try to write your own vulnerable application and then exploit it. At least, I'd much rather have them do that then copy and paste generic code off of some learning site which is vulnerable without even thinking about it.
I usually associate fanatical goto hatred (as in #4) with people who don't do systems programming, particularly in C, where using a goto to jump to a label that executes instructions (like cleanup and freeing memory) in the event of an error condition, is a very common pattern.<p>These people would probably be shocked if they read the source code of the average GNU/Linux distro's software stack.