>Our website uses a shared SQLServer and need to have VFP 9 connect to it using remote views.

Presumably, over the public Internet?

>No VPN can be used to connect to it.

Why not?

>Is the Remoteconnection string encrytped when it is sent to a remote SQLServer?

If it's not explicitly encrypted/decrypted via some sort of transport layer such as a VPN, it's going across the public Internet as plain text.

>If not, isn't that a huge security risk?

Depends on your definition of "huge", but it ain't good.

Anyone actively sniffing your traffic will immediately get your credentials. While this may not be common with wired connections, it's rife with wireless - if you're in a web cafe the other guy in the corner may be sniffing everything that goes out just to see what he can get.

Also, ISPs and law-enforcement agencies are increasingly logging traffic; you'd hate your credentials to be recorded to a log file for posterity.