3) very easy
1) nearly NONE! Do not use direct connection in your App! The recommended way is to use jRDC2 on your Server (here you can add security).
The DB-credentials can be stolen easily by a hacker when using direct connection.
(Though, if you got the skills to make a secure API (using PHP or whatever) then that will be fine too. But never ever do the direct connection thing. That's asking for problems.)