>>Yes, security is an issue.
>>The PHP/MYSQL apps I've developed are basically elaborate data collection and query applications that run on Ipads.
>>The MYSQL reference tables are clones of SQL Server tables and the data that's collected into MYSQL is replicated into SQL Server tables at tight intervals.
>>The browser app can't see the SQL Server, but the SQL Server can see the browser app.

If you haven't, check out DVWA. There's a lot of LAMP sites out there with all the standard security, yet wide open via unexpected command execution or injection exploits that haven't led to catastrophe because (so far) hackers aren't motivated to visit/aware of the site. IMHO you need significant resources and expertise in 2018 to dare expose a bespoke website to the wild.

Re RDS: As Victor notes, VPN may be enough if your users all have desktops or can use the app already. We moved to VPN some years back to expose as little as possible to the hacker world without as well as allowing secure access to company documents and email etc over airport wifi or whatever. There's quite good Linuix VPN endpoints or VPN hardware routers are fairly cheap these days too. I quite like the Draytek routers that offer fast hardware vpn.