Nothing is a security risk in and of itself. If you know basic PHP and the basic usage of
mysql_query and how to sanitize your input -- you're fine.
What you're proposing is not by any means a best practice, proper use of Views or the Drupal API (sorry).
- If you want to make Drupal aware of other databases see:
- If you want Views to be able to query an external DB table see:
- if you want to know how to describe your table to Views using the Drupal Schema API for an existing table see the Schema contributed module which leverages the built in Schema API of Drupal 7:
- If you want to make a view and alter its SQL or resultset see: (possibly interacting with another DB, or using PHP to alter the row results somehow, maybe by examining another db query result)
All of these options make use of Drupal core features for interacting with 3rd party databases, Drupal API or Views contributed module API.
Your approach is taking an embedded php field in a view and ignoring Drupal and its architecture to achieve what you want. It's as secure and safe as your experience and knowledge make it. I prefer to stand on the shoulders of others and leverage the security built into Drupal and its supported APIs.
You may find the Data module useful in making your 3rd party data play nicer with Views.
Data module helps you model, manage and query related sets of tables.
It offers an administration interface and a low level API for
manipulating tables and accessing their contents. Data module provides
Views integration for displaying table data and Drupal search
integration for searching table content.