Modern firewalls almost always come with more than two interfaces. A Fortigate 40c, for instance, one of the cheapest enterprise-class security appliances on the market, meant for SOHO applications, comes with 7! (Five of them can be configured into a switch... it actually comes configured like this from the factory! You can re-conf it into standalone interfaces, tho.)
Each interface can be firewalled from the others - you control what kind of traffic, and from whom, can traverse from one interface to the other. That's the firewall's job. More, most modern firewalls also do a credible job as a router... you can set up separate networks for your DMZ and your database server, and route between them, while filtering traffic.
So the answer is, buy a firewall based on the expected traffic load, and dedicate one port to the internet, one port to the DMZ, and one port to your DB server, set up your firewall policy and routing to control traffic between them.
It may be tempting to try to separate out the traffic using VLANs on the switch, but this is a bad idea if it's your security strategy - there are ways to traverse VLANs.