Well yes if you're stupid enough to directly expose your DB to the world then it's technically possible, but barring such idiocy there's arguably more risk of a DB hack through PHP than client side JS in most architectures.