我可以将数据库Web服务与生成的HTML一起用于Internet吗？

Question

I am planning a web site (Internet facing) and would like to generate the HTML directly from a Database using Database Web Server (with proxy). For, example, creating a SOAP web-service in an iAnywhere database .

This is in contrast to the "traditional" route of a PHP/C#/etc. application layer in between the client and the database. Before jumping on my head or lol .... I have read about reducing server load but expect that the database server can handle this, I have read about security isuues yet expect the logging in procedures and rights management in the database to be sufficient, sessions can also be handled etc.

Can anyone (without listing up the pros and cons of c#, PHP or any other programming language) help me on this decision please? I am aware that going the data base web service direction would mean a bit of re-inventing the wheel ...

Answer 1

Although in theory there is no technical reason not to do this, I would generally consider it to not be a great idea, for a few different reasons.

Your database query would be responsible for getting the data from the database and generating the HTML from that database. This is a possibility if you are just sending back really simple tabular data to the client. However, this would be the worlds ugliest and least functional site.

Development and maintenance

If you wanted to start including CSS, JavaScript, a navigation menu, or anything like that, then it would be a huge amount of work. It would almost certainly prove a maintenance nightmare.

If you can expand on why you want to do it this way, and the complexity of your web-pages then I'll expand my answer a bit more.

If you really wanted to do it this way, then you could use shudder iFrames to have a basic site-structure, and load database-generated pages into the iFrame.

Alternatively, you could have a more traditional site, but use AJAX techniques (typically in conjunction with jQuery) to get JSON data from the database and display that.

Security

A sensibly developed web-site (ie one which avoids SQL Injection attacks, etc.) will remove almost any attack-vector against your database (which will not be internet visible). Your way, you are relying on the database itself to provide that security. In principle that's possible, but you would want to spend very good money on a DBA who really knew his stuff to ensure that.

Development Resources

There is a whole wealth of resources out there (tutorials, code samples, stack-overflow, etc.) to aid you in implementing the traditional architecture. You won't get this same support for the direct-database approach.