Hi Vura,
The best practice is to use a Web Service because it abstracts the connection allowing the XML and/or the DB to change without republish or recompilation. No code in your form is required and the Web Service is the only viable solution for browser-based forms accessing a database when permissions are required.
The second best practice is to create a form from the database by specifying the database when you begin designing the form. The benefit is that no code is required in your form. Unfortunately, this only works for new forms (forms that already exist with XML data cannot be converted into database forms). In addition, extra configuration has to happen (SSO) if your SQL database is on a separate server and you are using IPFS (browser based forms). You cannot support fine-grained permissioning with this option because IPFS does not impersonate the user.
Finally, you can write code in your form to submit to SQL but it will likely require full trust form (not a best practice) and the code will be specific to your form. In other words, you will have to re-code the form whenever the schema or database changes and for all new forms.
The Web Service option is the cheapest approach for quick deployment now and for lower cost maintenance costs long-term.
Cheers!