Is it a best practice to use stored procedure for every single SQL call in .NET applications?

Is it encouraged for performance reasons and to reduce surface area for SQL injection attacks (in web applications)?