B4J Question Connecting to database server

JackieBlue said:

This is what I see is recommended for using databases

Click to expand...

Not exactly true.

You are talking about jRDC2 which is a middleware server between the clients and the database. jRDC2 is the recommended way with mobile apps. With a desktop app both options are good: connect directly to the database (jSQL) or use jRDC2 as a middleware.

If you choose to use jSQL then make sure to use the (very simple) async methods: [B4X] SQL with Wait For

Good Day and Welcome

You have 3x options
1. You can connect via a php script somewhere (done at your own risk - not secure)
2. You can connect direct to the SQL Server (again - risky)
3. You can use jRDC2 as you describe above (secure - worth the extra bit of work - it is also much quicker than points 1 and 2 above)

My scenario
One of my apps is medically inclined and I need to read and write confidential information to the database. At the risk of an MITM or SQL Injection attack, I could loose my clients and business if I am not careful and can prove that I have tried every method there is to keep the data safe (local SA law).

If you use the php method or the direct method, you actually send your SQL query where it can be intercepted, modified and who knows what. If you use jRDC2 then you do not send the query as it is resident in the config.properties file on the server and you essentially only send a "code" to the server that looks up the query in the file and then executes it and return the data to you, and believe me, it might sound like a rigmarole but it's safe and very fast.

The second tip. On my SQL server, I use procedures that I call from my app. In this way, should there be any changes to your query, you do it on the SQL server and leave your config.properties and jRDC2 server intact.

Now your questions:

1. So, it looks as if any SQL you want to execute must essentially be in the config.properties of the B4J server, correct?

Click to expand...

Correct

2. Same for stored procedures, you just define in the confic.properties of the B4J server?

Click to expand...

No Sir, you define them on your SQL server and you just call them from your config.properties and the jRDC2 server

Like this, for example

3. Why is all this extra work needed? Most programming languages I've used allowed me to connect to the database and call directly. Not go through the server and and configure additional commands.

Click to expand...

As explained above about speed and security

And as @Erel is quicker than me on the keyboard - his answer too is spot on !!

I trust this will help

Erel said:

If you choose to use jSQL

Click to expand...

Check this tutorial

Thanks everyone . Interesting. I've never used an extra layer in any application I've developed but I've only done web (mostly classic asp and php) and old school client/server desktop apps.

@BillMeyer - regarding stored procedures, yes, they are created on the server but you have to put the execute code in the config.properties which was my real question.

The extra work definitely provides security. I honestly do not see how creating a jRDC2 would quicker.