I'm creating a browser RPG in Flash which will have some multiplayer elements and in-app purchases so security is a high concern. Would it be better to have all game stats like health and such exist only in the MySQL database and retrieve them every time I need them? The game is turn based, but that would still require very frequent connections to the database. I could use local copies to cut down on the number of connections, but I imagine that would make it much easier for people to cheat.
"All the logic will be handled in Flash" there's your problem.
It doesn't matter where you store the stats if I can hack my client to ignore them and just always report back "Yeah, I toooottally won that duel. Rank me up!"
To prevent cheating, what you need to do is run your duel logic on the server. Then it doesn't matter if the player hacks their local client to pretend they have 9999999 strength & HP or whatnot. That server does its own calculation with its own authoritative stats, and records/reports the result of the duel with that trustworthy information.
That way a player hacking their local copies of the stats, or any other part of the client, cannot change the game experience for anyone else, nor impact the rankings.
If your duel logic is deterministic, then your client and server don't need to communicate in realtime about the blow-by-blow. The client can still run its own duel logic for presentation to the player. The server can, at minimum, record the player's inputs and the time when the duel was initiated, so it knows what state to use whenever it decides to compute the outcome later (when it has time / when a player asks to see the results).