I think HTML5 has ushered in a bit of a golden age for client-side developers. It's *so* much more powerful than its predecessor. The two "new" additions that I think are the coolest are the canvas tag and the new client-side storage capabilities.

You'll want to throw in at least a little JavaScript, and there too we have an embarrassment of riches, especially with all the new libraries. jQuery remains my personal favorite, though it's now considered old hat by most of the industry.

To the best of my knowledge, security still remains something best handled on the server. The amount of dialog, hand wringing, blood, sweat and tears that have gone into trying to secure the client-side is truly impressive, but...personally, I just wouldn't. You might think to store passwords on the client-side encrypted with an irreversible hash, but remember you'd also be handing your security routines over to the bad guys as well. Talk about holding up a red cape. And there are ways to *try* to keep them from simply re-writing your javascript, but from what I've seen they put a huge amount of faith in the browser--why chance it? Sure, there are no guarantees that they can't get to your server-side code, but at least you're probably not handing it to them on a silver platter.

It's just way better to handle security on the server...imho. And given the choice between using an Access database file or a SQL Server instance, go with the latter. Even the express version works just fine for web apps, or at least it did in the past. If you're using .net, store your db login credentials in the recommended place, which used to be the app.config file (that may still be the case, I don't know).

I can't address your SEO questions.

What you've outlined is fairly standard fare for web apps, so there's lots of references, tutorials and code samples online. Don't be shy about asking for help--unless you're also the server admin, you may well need it. I've seen apps fail on a production server after working like gangbusters in the development and testing environments. Buy lunch for your favorite network engineer and the server admin and get their 2 cents before starting.

There's absolutely no doubt in my mind that you could do this, just make sure your boss knows you will need time for testing and maybe troubleshooting.

And yes, I too am eager to read Robert's insights on this :-)

Best of luck, Rob, no matter what you decide.