it is a matter of requirements not some universal law.If it makes sense to put it in the app and you do not particularly care about performance or security (because you trust your users) then put it in the app. I would have a problem with letting an untrusted user execute direct queries against my database though - the app has to log in somehow to the database with a username and password, and it is