[Shawn Clarke]

Yes you can. 🙂

[Shawn Clarke]

Agree with @utsav . I also found a soultion, hope that would help.
Got to http://www.algoworks.com/blog/how-to-integrate-salesforce-with-external-database/
@abhay, please let me know if it helps.

[Shawn Clarke]

Though it is not mentioned anywhere explicitly, the managed packaged apps are first tested by automated scripts from Salesforce.com side, and once found, they flag JS code as possible Cross-Site Scripting vulnerability.

Custom Javascript code is always vulnerable to ‘Code Injections’ and are therefore considered a security risk by SFDC. Checkout this post to understand more
https://developer.salesforce.com/page/Secure_Coding_Cross_Site_Scripting

The problem has a twofold solution. First you have to make sure that you are using proper encoding functions around your JS codes
``

Once you have done that, you can request re-review of your app. You would have to convince the review team that your app was flagged a false positive and is not vulnerable.