I had a project that needed to pull from a database. I setup a php webpage that handles the request as a go between.
For security I just send a token to the php page that tells it to run a pre-configured SQL query. That way there is no chance
of someone doing an SQL Injection.
I return the data as JSON.