John,

>As long as you don't rely on stored procs or security....

Security is not a problem with my web apps, since I can lock down the tables or directories to allow access only to my EXE(s), which are called by the Web Connection ISAPI dll. In the EXE code, I can also require NT user authentication before allowing the hit to proceed in accessing the tables (usually by instantiating business objects) and creating HTML.

I'm not currently using stored procs in that scenario, but there would not be a problem doing so, since I'm not going through ODBC, but am talking directly to the tables/DBC in my data-access classes inside the VFP EXE.

Performance-wise, this architecture really flies. Even under heavy load, I'll have only a few EXE instances handling the hits round-robin, with each hit typically taking just hundredths of a second.