I would say both code database. Perhaps also a software component, in the server-side, to leverage access to databases and have a kind of poor cache (the actual intention is not to do cache, but maintain objects as being alive).
With code you will define basic algorithms and, perhaps, rebalance the enemies in the future. Perhaps the code could involve a script loaded from database which could be maintained and modified as required (note for purists: using code evaluation under this requirements would not be unsafe since only the application administrators could configure them. Even enterprise software like OpenERP can have code chunks for certain record types and nobody complains about that).
With database you could store the deltas for each stat (e.g. in a Pokemon-like game, a delta would be a stat modified temporarily by an attack or an item). In a Pokemon-like game, also the permanent stats are saved into database (since there are objects that alter the permanent stats).
So your needs will depend on the type of stats for your NPCs:
- Base stats, able to be permanently and temporarily modifiable: Use code for when the NPC raises a new level (if it is the case) or for initial calculations. Use database for actual permanent values, and choose either between database or just memory for temporary modifications.
- Base stats, able to be temporarily modifiable: Use code for initial calculations. Choose either between database or just memory for temporary modifications.
- Base stats, not modifiable anyhow: Use just code for the initial calculations.
Architectural considerations: Your HTTP server should be able to maintain live objects globally between different HTTP sessions. Cases like Tornado and Twisted (for Python) or almost any java web framework can help you. For PHP you will need a database (since you cannot globally have in-memory live objects).
Notes: Maintaining live objects It is also not the case with architecture based on worker processes (synchronous-based servers like Python/gunicorn fall in this category) since each worker process would maintain a copy of the live objects and that would be troublesome for similar reasons than using PHP.