As for the Yubikey, you will pay for a key and the service itself would of course be offered free of charge, making it effectively a one time fee.
HOTP clients are available for most smartphones. No SMS needed then, and free for the end-user. An alternative would be HOTP hardware tokens (Yubikey supports HOTP too, in one of it's two configuration slots).
Still doesn't improve your database security though