Your sql logic is meant to be server side to prevent security breaches and ppl fuxing with your database , don't throw money at anyone for a feature like this, you'd be putting you and your users at risk.
Yes sql is meant to be on server side and C2 MP plugin is there to be use to make the "bridge", the concept is to create a C2 project as the host and run it in a browser on the server. Well it is a flimsy server but for a small scale game, I think this is acceptable as the code for the host is theoretically unreachable, I dont see any reason for hackers to put effort in screwing up the game for an imaginary profit.
My thought is, to be able to do this, I have to get a VPS at least and run the index.html (call it a lobby host) on a browser through remote connection. The silly setup that I have now is a very small C2 project that keep the highscore on the serverside webstorage. The client send an array.asjson instead of numerical variable, as to prevent cheating, then the lobby host just calculate the score and then send it to mysql on client behalf.
This webstorage data is not visible for me through normal means, so I set the browser to download the file asjson for every hour or every 30 minutes just to get data that I can read. This way I will have a continuous pile up of text/json file which I definitely think is not good, the data should be handled by mysql instead.