Just a thought.
! was told, in general, the answer is a query.
I use queries wherever possible. I use code, when I can't do it with a query - perhaps the query is non-updatable.
It's hard to get the precise percentage, but a good deal of my code is defensive - controlling the look and appearance of the dbs, checking for legitimate values, confirming that user input and so on.