Kalpana Kalpana (Editor)

Oracle Application Express

Updated on
Edit
Like
Comment
Share on FacebookTweet on TwitterShare on LinkedInShare on Reddit
Developer(s)
  
Oracle Corporation

Website
  
apex.oracle.com

Stable release
  
5.1.0.00.45 / December 21, 2016 (2016-12-21)

Operating system
  
Windows, Linux, Oracle Solaris, HP-UX, IBM AIX

Type
  
Oracle database development environment

License
  
Oracle Technical Network License (proprietary)

Oracle Application Express (abbreviated APEX, previously named Oracle HTML DB) is a web-based software development environment that runs on an Oracle database. It is fully supported and comes standard (at no additional cost) with all Oracle Database editions and, starting with Oracle 11g, is installed by default as part of the core database install.

Contents

APEX can be used to build complex web applications which can be used in most modern web browsers. The APEX development environment is also browser-based.

Releases

Oracle Application Express can be installed on any Oracle database from version 9.2 or higher, and starting from Oracle 11g it is installed with the database by default. APEX 4.0 and higher can be installed on an Oracle 10.2.0.3 or higher database. APEX 5.0 and higher can be installed on all editions (SE1, SE, and EE) of the Oracle database, 11.1.0.7 or higher with a valid Oracle Database Technical Support agreement; it can also be used with Oracle Database 11g Express Edition (XE), but is supported through the Oracle Technology Network discussion forum, and not through Oracle Support Services.

Background

Application Express has gone through many name changes since its inception in 2000. Names include:

  • Flows
  • Oracle Platform
  • Project Marvel
  • HTML DB
  • Application Express (APEX)

    • APEX was created by Mike Hichwa, a developer at Oracle, after development of his previous project, Web DB, started to diverge from his original vision. Although APEX shares some functionality with Web DB, it was developed from scratch and there's no upgrade path from Web DB to APEX. When tasked with building an internal web calendar, Hichwa enlisted the help of Joel Kallman and started development on a project called Flows. Hichwa and Kallman co-developed the Web Calendar and Flows, adding features to Flows as they needed them to develop the calendar. Early builds of Flow had no front-end so all changes to an application had to be made in SQL*Plus via inserts, updates and deletes.

    APEX is used internally by Oracle to develop some of its support sites. The AskTom knowledgebase and online store both run on APEX. The Metalink support site ran on APEX for some time before it was eventually replaced by an Oracle ADF solution.

    Advantages

  • DBAs familiar with PL/SQL can use their skill set to develop web applications
  • Easy to create mock-ups using pre-built themes
  • Easy to deploy (end user opens a URL to access an APEX application)
  • Scalable (can be deployed to laptops, stand-alone servers, or Oracle RAC installations)
  • Server-side processing and validations
  • Strong and supportive user community (especially Oracle APEX forum)
  • Basic support for group development
  • Free hosting of demo applications provided by Oracle
  • Apex applications can run on the free Oracle Express Edition (XE) database
  • Individual components of an application can be retrieved or identified using SQL, facilitating customized reports
  • Easily adheres to the SQA development/test/production model (while not exposing DB passwords)
  • Helps put the focus on the DB model supporting a solution (versus coding in Java, .NET or PHP - you only need JavaScript)
  • Easily supports a standardized theme across application sets (and the changing of that theme)
  • Semi-technical end users can build their own web pages and reports

    • Disadvantages

  • Large installation size. The unzipped installation files for Apex 4.1 that includes 9 different languages for the "Application Builder" interface is 747 megabytes. The English-only version is 147 megabytes. Apex is installed on the database server; developers and users only need a web browser to build and use applications.
  • Primary keys can be at most two separate fields. However, since version 4.1 Application Express supports the use of ROWID for updates, inserts and deletes as an alternative to specifying primary keys. Prior to version 4.1 APEX assumed by default that all tables would use generated keys such as from sequences or triggers, therefore, if a table had more than two key columns then the default DML processes could not be used.
  • Pages in APEX can display at most 200 items and forms cannot handle more than 200 database items. Compare this to the Oracle Database where tables can have up to 1000 columns. Pages must be designed to work around this limitation, for example by using multiple pages, tabular forms, or Ajax for on-demand updates.
  • Reporting capabilities in APEX are provided by report regions which offer fairly limited capabilities. However, efforts have been made to address this limitation through integration of other reporting products.
  • APEX applications are created using Oracle's own tools and only can be hosted in an Oracle database, making an implementer susceptible to vendor lock-in.
  • Very few webhosts offer APEX (Oracle Database) on their hosting service package (most of them offer PHP + MySQL or ASP + Microsoft SQL Server). As a result, APEX applications are limited in their choice of webhosts.
  • Projects requiring multiple developers to touch the same web page will need to communicate their intentions with each other. There is no built in version control and all components must be edited through the web interface. Page locking can help guard against physical dependencies.

    • Security

    There is a common misconception that the abstracted nature of APEX applications results in a relatively secure user environment. However, APEX applications suffer from the same classes of application security flaws as other web applications based on more direct technologies such as PHP, ASP.net and Java.

    The main classes of vulnerability that affect APEX applications are: SQL injection, Cross-site scripting (XSS), and Access Control.

    APEX applications inherently use PL/SQL constructs as the base server-side language. As well as accessing data via PL/SQL blocks, an APEX application will use PL/SQL to implement authorization, and to conditionally display web page elements. This means that generally APEX applications suffer from SQL injection when these PL/SQL blocks do not correctly validate and handle malicious user input. Oracle implemented a special variable type for APEX called Substitution Variables (with a syntax of &NAME.) and these are not safe and lead to SQL Injection. Where the injection occurs within a PL/SQL block an attacker can inject an arbitrary number of queries or statements to execute. Escaping special characters and using bind variables is the right way to code to ensure no XSS and SQL injection.

    Cross-Site Scripting vulnerabilities arise in APEX applications just like other web application languages. Oracle provides the htf.escape_sc() function to escape user data that is displayed within a rendered HTML response. The reports that APEX generates also provide protection against XSS through the Display As setting on report columns. Originally the default was for reports to be created without any escaping of the columns, although recent versions now set the column type to escape by default. Column definitions can be queried programmatically to check for columns that do not escape the value.

    To control access to resources within an APEX application a developer can assign authorization schemes to resources (such as pages and items). These must be applied consistently in order to ensure that resources are appropriately protected. A typical example of inconsistent access-control being applied is where an authorization scheme is set for a Button item, but not the associated Process that is performed when the button is clicked. A malicious user can perform the process (through JavaScript) without requiring the actual Button to be accessible.

    Since APEX 4.0, the Application Builder interface provides some limited assessment of the security posture through the Advisor utility.

    Third-party libraries

    Developers may improve and extend their APEX applications by using third-party libraries that APEX comes standard with. Among them are jQuery Mobile (HTML5 based user interface), jQuery UI (user interface for the web), AnyChart (JavaScript/HTML5 charts), CKEditor (web text editor), and others. Experts say it is an advantage of applying the latest APEX patches that the external libraries which come with APEX carry an update, too. However, many of the libraries come out with newer versions more frequently than there are APEX patches.

    APEX and Oracle Database Express Edition (XE)

    Oracle Application Express can be run inside Oracle Database Express Edition (XE), a free entry-level database. Although the functionality of APEX isn't intentionally limited when running on XE, the limitations of the database engine may prevent some APEX features from functioning. Also, Oracle XE has limits for CPU, memory and disk usage.

    References

    Oracle Application Express Wikipedia
    (Text) CC BY-SA