What is the most secure way to go from an web interface(HTML5 for example) to an sql database? Should there be a middle man? [on hold]

I want to create a simple inventory database with a web interface for my dad to use with his business. It will be over internet. Not looking for a specific answer, just looking to be pointed in the right direction.