Mobile platform communicating directly to database or via web service?

I see two ways of going about feeding data to and from a mobile application.

First would be to directly connect to the database and perform queries directly.

The other option would be to build a REST API and indirectly interact with the database through a web service. There's a bit of a security hole here, which makes me think the former might be best.

I realize this doesn't touch 开发者_运维百科specifically on a question about code, but moreso on the methodology of the scenario.

What are your thoughts?

The usual way would be through a REST API (or some other kind of web service / service layer).

Putting the database open in the wild, directly accessible from any outside device, is certainly a bigger security hole than using a service layer.

Plus, if your database is hosted by some web hosting company, there is a big chance that it's not even accessible directly from the web, only from the webspace you ordered with it (for security reasons!).
So you have no other choice than using a service layer in this case.