Why accessing database from android application isn't secure?

Question

I'm working now in an android application which will get the some data from MS sql database. I used jtds jar file to connect to the database, but I read that connecting to database from the application directly is not secure and I should use a web service. but I can't understand why?! .. can some one help me?

Also, I found a lot of tutorial explaining the connection using a web service using REST. But all of them depends on I have a php file then send HTTP request then parse json string. So should I create this file myself!

Answer 1

You should never connect to a database from within your app, because in order to do so you are embedding your database credentials in your application. Which means that anybody with a decompiler can get those credential and do what they please to your database with that.

here's an example of what happens when you do that =)

http://gamingirresponsibly.com/team-meat-learns-a-hard-lesson-by-hackers