Rather than coding security checks, update statements, etc, etc throughout your HTML layer, you should theoretically code the bulk of that in the API layer. The HTML layer will then make simple function calls that return either arrays, objects, or (my favorite) database result sets.

If you do this right, the topmost layer will be very thin so you can easily create/maintain it.

Drawing from this example, the HTML interface depends on some direct calls to the API layer, some calls to an HTML utility library (which could, for example, generate pop-up boxes, or whatever), and those libraries make calls to the database using a database abstraction layer (again so you aren't tied to any particular database).