In which layer do DAO classes belong in a 3-tier architecture of a web app?

Question

Let's consider a BookDAO class, for example, that needs to populate a list with every existing book. To my mind, this class belongs to the lowest layer (data access layer), but I've seen it as part of the middle layer (bussiness logic) too. Which of the above is correct?

Answer 1

1. Keeping the DAO in the business layer has its own negative effect on the integrity of the system. One of the issues is the security of the data. APIs usually interact with the business logic. Mixing business logic and DAOs would give direct access to data to APIs.
2. Imagine a situation where you need similar data for various operations in business logic. Keeping DAO in the data access layer would help in using the same data retrieval for both the operations.