I have written some applications in Delphi for a production company, the purpose of this application is label printing and production data acquisition.All of these applications are Client-Server (Using ZeosLib connecting directly to PostgreSQL through 5432 port).

In recent days, the company has acquired other production sites and wants to install my software in these sites. It's not possible to make a LAN2LAN connection, and the only way to communicate from external production sites to corporate headquarters is via HTTP (https) server through internet connection.

When I was presented with the problem, the first thing I thought was to convert applications to use REST and write all server side queries making calls to the right endpoints. However, this requires a lot of work: applications have many queries to rewrite.

Therefore, for time reasons, I tried to create a server side PHP script capable of receiving requests written in SQL, connecting to PostgreSQL and responding in JSON data. After that, I have modified my application extending ZeosLib connections with an additional protocol (named websql) able to redirect SQL queries to the PHP script and convert the received JSON data to Delphi DataSet compliant format.

Everything works fine: in all my applications I can now change the connection protocol with the new "websql", and I could quickly install the new versions in the branch offices.

Doing this test was very simple, but now there is a security problem: The Web connection is protected by user/password and by https, but is it still sufficient?
Should a client application be allowed to send queries via https? Before installing the applications in production I would like to know if there is a way to make this architecture as secure as possible or if it is appropriate to rewrite all the applications with REST communication.

Thank you all,

Andrea