title: What are the security benefits (or drawbacks) to wrapping a HTTP server around a SQL Server?
body: <p>Assume the server is public, and only requires a password to interface with. </p>
  
  <p>The public option seems to be "always restrict your SQL Server to known IP's".</p>
  
  <p>When I respond with "What if I want anyone to be able to connect to the server?" I am told I should basically set up a HTTP server to act as a mediator between the SQL Server and the public.</p>
  
  <p>Wouldn't it just open up my server to now not only attacks on SQL but also HTTP? Wouldn't keeping the system as simple as possible be the right move from a security standpoint?</p>
  
  <p>What type of attack(s) in particular would this protect against? </p>