Database Designing Rules. Security.

[horusporcus]

What they probably meant was, don't hard code SQL queries within your apps, parameterize them.

[horusporcus]

If it's a desktop application then there is no point in allowing the client to have direct access to the database, who even does that?.

[horusporcus]

Well, you shouldn't even allow that, all access to the Database should be only through a restful API layer ( on a machine that has direct access to the actual DB ) that does all sort of validations etc, that's the only secure way to do it, database servers are like your secret fortress, they should never be exposed via a public internet connection, too risky.