(Moved from Stack Overflow as other users said it was a security question)

I have a mysql database sitting on a remote server. Nothing else, ie no web site using it, no server side scripts etc, nothing except remote access from an application that I wrote myself in Depli. That application runs on about a dozen machines around the country.

I have set up the allowed IP addresses using the remote mysql tool in cpanel. The problem is some users have dynamic IP addresses so they frequently complain they can no longer get in. Wildcards seem ineffective as even the first octet changes sometimes. The only solution is to use %.%.%.% (some sources say it should be %%%.%%%.%%%.%%%) but eitherway I am aware this reduces security.

The question is what would I (or anyone else) need to hack into the database if the wildcards allowed their IP address?

In my mind a hacker would need to know A) There is a database there in the first place B) The name of the database C) The name of the single user I have set up D) the password for that user

Can any expert programmers out there tell me if allowing access from any IP address would compromise security unduly?