Jump to content

Oracle Application Express

From Wikipedia, the free encyclopedia
(Redirected from Html db)
Oracle Database

Oracle APEX
Developer(s)Oracle Corporation
Stable release
24.1 / June 17, 2024 (2024-06-17)
Operating systemWindows, Linux, Oracle Solaris, HP-UX, IBM AIX[1]
LicenseOracle Technical Network License (proprietary[2])
Websiteapex.oracle.com

Oracle APEX (Oracle Application Express, or APEX) is an enterprise low-code application development platform offered by Oracle Corporation. APEX is used for developing and deploying cloud, mobile and desktop applications. The platform provides a web-based integrated development environment (IDE) with tools such as wizards, drag-and-drop layouts and property editors in order to simplify the process of building applications and designing user interfaces.

Background

[edit]

APEX is a feature of the Oracle Database. It is a part of Oracle Cloud within Autonomous Database Cloud Services and the stand-alone APEX Application Development service.[3]

Oracle APEX has had name changes since its creation in 2000, including:

  • Flows[4]
  • Oracle Platform[5]
  • Project Marvel
  • HTML DB[6]
  • Application Express (APEX) aka Oracle APEX[7]

History

[edit]

APEX was created by Michael Hichwa, an Oracle developer. Following from his earlier project, WebDB. When tasked with building an internal web calendar, Michael Hichwa employed Joel Kallman and began developing Flows. Hichwa and Kallman also co-developed the web calendar, adding features to Flows as they needed them to develop the calendar. Early builds of Flows had no front-end, so all changes to an application had to be made in SQL Plus via inserts, updates and deletes.[8]

With version 5.2, the numbering was changed to 18.1, indicating the year and quarter of release. This change is associated with Oracle's change in numbering nomenclature.

Low-code environment

[edit]

Oracle APEX is a low-code development platform. These low-code environments can trace their origins to fourth-generation programming languages and rapid application development (RAD) tools. Since APEX was originally marketed as a RAD tool, this progression is a logical one. APEX allows users to build web applications with no code. When the requirements are more complex, APEX allows the extension of the low-code objects through a declarative framework. This framework lets the developer define custom logic, business rules, and user interfaces. The developer can do this through the inclusion of SQL, PL/SQL, HTML, JavaScript, or CSS as well as APEX plug-ins. APEX permits developers to go from no code to low-code to more code.[9][10]

Security

[edit]

APEX applications suffer from the same classes of application security flaws as other web applications based on more direct technologies such as PHP, ASP.NET and Java.

The two main classes of vulnerability that affect APEX applications are SQL injection and cross-site scripting (XSS).[11]

APEX applications inherently use PL/SQL constructs as the base server-side language and access data via PL/SQL blocks, an APEX application will use PL/SQL to implement authorization and to conditionally display web page elements. This means that generally APEX applications suffer from SQL injection when these PL/SQL blocks do not correctly validate and handle malicious user input. Oracle implemented a special variable type for APEX called Substitution Variables (with a syntax of "&NAME."); however, these are insecure and can lead to SQL injection. Where the injection occurs within a PL/SQL block, an attacker can inject an arbitrary number of queries or statements to execute; escaping special characters and using bind variables ensures the reduced likelihood of XSS and SQL injection vulnerabilities.

XSS vulnerabilities arise in APEX applications just like other web application languages. Oracle provides the htf.escape_sc() function to replace literal characters with HTML entity names and avoid undesired behaviors.[12]

A developer can assign authorization schemes to resources (such as pages and items) to control access to resources within an APEX application. These schemes must be applied consistently to ensure that resources are appropriately protected. A typical example of inconsistent access control is when an authorization scheme is set for a button item but not for the associated process performed when the button is clicked. A malicious user can then perform the process through JavaScript without needing the actual button to be accessible.

Since APEX 4.0, the Application Builder interface provides some limited security posture assessment through the Advisor utility.

Third-party libraries

[edit]

Developers may improve and extend their APEX applications by using third-party libraries. Among them are JQuery Mobile (HTML 5-based user interface),[13] JQuery UI (user interface for the web),[14] AnyChart (JavaScript/HTML 5 charts),[15] CKEditor (web text editor),[16] and others. Oracle states that applying the latest APEX patches ensures that the external libraries bundled with the platform are updated alongside it, enhancing application stability and security.[17] However, many of the libraries are updated more frequently than APEX patches are released, requiring developers to monitor and manually apply updates as necessary to maintain compatibility and security.[18][19]

APEX and Oracle Database Express Edition (XE)

[edit]

Oracle APEX can be run inside Oracle Database Express Edition (XE), a free entry-level database. Although the functionality of APEX isn't intentionally limited when running on XE, the limitations of the database engine may prevent some APEX features from functioning. Furthermore, Oracle XE has limits for CPU, memory, and disk usage.[20]

See also

[edit]

References

[edit]
  1. ^ "Oracle Application Express - Downloads". Oracle. Retrieved December 10, 2015.
  2. ^ "Oracle Application Express Documentation". Oracle Help Center.
  3. ^ "Oracle Application Express (APEX): Overview" (PDF). Oracle Corporation.
  4. ^ "Welcome to Flows for APEX". apex-flowsforapex. Retrieved September 24, 2021.
  5. ^ "Implementing Oracle API Platform Cloud Service". Packt. Retrieved September 24, 2021.
  6. ^ "1 What is Oracle HTML DB?". docs.oracle.com. Archived from the original on September 24, 2021. Retrieved September 24, 2021.
  7. ^ "Apex Developer | Limestone Digital". limestonedigital.com. September 3, 2021. Retrieved September 24, 2021.
  8. ^ "Michael Hichwa". Apress. Michael Hichwa is the original developer and architect of Oracle Application Express (APEX), aka HTML DB. Michael created APEX as a 100% rewrite of an earlier browser-based application development tool he also created, called Oracle WebDB. He had invaluable technical assistance and guidance from Tom Kyte and the addition of Joel Kallman as a co-developer. Michael and Joel have led APEX development efforts since 1999
  9. ^ Kallman, Joel. "From Low Code to High Control". Retrieved November 27, 2017.
  10. ^ "Low Code with Oracle Application Express". apex.oracle.com. Retrieved November 27, 2017.
  11. ^ "Securing Vulnerability Exploits with Apex – Part 3". content.dsp.co.uk. Retrieved October 8, 2024.
  12. ^ "Fusion Middleware PL/SQL Web Toolkit Reference". docs.oracle.com. Retrieved October 8, 2024.
  13. ^ "Building a Mobile Web Application Using Oracle Application Express 5.0". Oracle.
  14. ^ "Application Express Application Builder User's Guide". Oracle.
  15. ^ "Oracle APEX: Using AnyChart products with Oracle Application Express (APEX)". AnyChart.
  16. ^ "Oracle chooses FCKeditor for Application Express". CKEditor.com.
  17. ^ "Oracle Application Express (APEX) Patches". Oracle Base. Retrieved December 30, 2024.
  18. ^ "Goodies - APEX 4.2.2 included Libraries". Dimitri Gielis Blog. May 8, 2013. Retrieved December 10, 2015.
  19. ^ "APEX 5 first peek". Grassroots Oracle. March 17, 2014. Retrieved December 10, 2015.
  20. ^ "Limitations of the Express Edition". Oracle Corporation. Retrieved May 22, 2013.

Bibliography

[edit]
[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Oracle_Application_Express&oldid=1266196231"