What is point of encrypting wallet, if Bitcoin API's sendtoaddress needs passphrase? The Bitcoin API enables programs on the server to use JSON RPC to interact with the Bitcoin wallet.  Most commands do not need the wallet locked (which I assume is the same thing as encrypted).

Though, it would be nice to encrypt the wallet.dat file on the server for extra protection.  However, it doesn't seem that I can get any extra protection if my program needs to use the passphrase to execute JSON RPC commands such encryptwallet and sendtoaddress.  My program and wallet will be on the server.  If a hacker accesses my server, he can get the passphrase from my program file and then use that to access the wallet on my server.

Therefore, is there any point in encrypting the wallet on the server, if I need to use commands such as sendtoaddres which needs the passphrase on the server?
The wallet passphrase is there to protect the wallet file on disk. It is not an authentication mechanism or a security measure against anyone who can see what is sent to it. It does however prevent private keys from hitting disk in readable form.