I'm new to this whole dll thing but ...

When I issue

ox=CREATEOBJECT(foxis.pubs)
?ox.startup()

I get a screen full of HTML.

The SQLCONNECT in the form specifies DSN, username and password and so does not require user intervention.

And, like I said, the app. worked fine as an .exe so I don't think there are any security issues.