Remote database good practice

Question

we are creating a WinForms .NET4 app with MS SQL Server and we are deciding between two scenarios:

1) WinForms application directly connects to the MS SQL Server.

2) Use 3-layer architecture and insert a WebServices in between.

Questions:

1) Is it a good practice to open SQL connection publicly to the "world"?

2) Which scenario would you recommend. App is data oriented, quite simple and not planning any other client, only the WinForms one.

Thanks in advance.

James

Answer 1

Definitely go with the option having a web services layer. This allows you:

• to continue using your domain model (POCO and serialization).
• to avoid opening your SQL Server to the internet.
• to apply advanced business logic in your web services.
• to remove SQL logic from your client application; all the data access belongs on the app tier.
• to apply security rules/constraints as you need. Block a customer/user or IP address for various reasons.