It depends on what you mean by 'web based'. If the DBF files are on a private network which is distributed across the internet, i.e. a WAN, and are located in a shared location that you can access via a UNC (\myserver\myshare\myfile.dbf) then you *could* use them directly however IMO it will be slow, unreliable and prone to corruption. The DBF locking mechanism is anachronistic as it is, adding the internet to that is just asking for trouble.
In this scenario SQL Server or indeed any full-fat database server like PostGres or MariaDB would be far better.
If instead this access is to happen across the public internet then you need to use a web service, this is the most secure and reliable approach whether the data is in DBFs or SQL Server or whatever else. You do not want to open database server to the public internet. So you would have a service on the same machine as the database server (or the same LAN) which accepts requests for data or instructions to update and sends that to the database server (or acts directly on the DBF). So you are sending (probably) JSON or XML back and forth, with security in place so that you have to supply credentials.