title: Connecting to SQL database directly or through a client-server service
body: <p>Hi i'm currently creating a game using c# xna and will be allowing users to have some sort of profile system. So they can create account, sign-in view profile, achievements etc.</p>
  
  <p>While I am testing this I am using a local instance of SQL Server Express. In testing this is fine, however when creating the finished product is it ok to simply change the connection strings to connect to a remote publicly accessible SQL server or would this have security implications.</p>
  
  <p>Could someone for example be able to find out the user-name / password for the SQL server through the program and then connect manually and wreak havoc?</p>
  
  <p>Should I instead be looking to connect to a server side application which queries the database on behalf of my client side program to prevent the client side directly accessing my database or is this an unnecessary abstraction?</p>