I think, If it's going to be done, security should be implemented in the
client side and the server side.

Middle tier could protect the database to some extend but it's a known fact
that more than %50 of the attacks come from inside of the company. A
firewall is completely useless for this. A curious and informed company user
can run a sniffer program listening the system operators machine all the
time and search for the text "SYSDBA". What if he gets it? Beleive me
that's a very easy thing to do.

I may offer implementing a secure shell or pgp like approach.. In this
system there are two pairs of keys. One key is distributed to the
ublic( this is the public key) and there's one more key( private key). If a
client is going to send anything to a host, client scrambles the content
with the public key. From now on, no one, also the client can't decrypt the
content. The content could only be decrypted with the private key which
reside on the server. So only the server can decrypt it.

I don't know if one way encryption is enough. It may be..The server could
return clear text upon a encrypted request.

Or maybe, just setting up the connection could be encrypted and the rest
still remains clear text? This could be optional.

I don't think this will be the hardest thing to do.