Oracle Application Express

Oracle APEX

Developer(s)	Oracle Corporation
Stable release	23.2 / November 14, 2023 (2023-11-14)
Operating system	Windows, Linux, Oracle Solaris, HP-UX, IBM AIX [1]
License	Oracle Technical Network License (proprietary [2] )
Website	apex.oracle.com

Oracle APEX (also known as APEX) is an enterprise low-code application development platform from Oracle Corporation. APEX is used for developing and deploying cloud, mobile and desktop applications. The platform is a web-based integrated development environment (IDE) with a range of features including wizards, drag-and-drop layout and property editors to simplify the process of building applications and pages.

Oracle APEX IDE

Background

APEX is currently a fully-supported no-cost feature of the Oracle Database and can be installed anywhere Oracle Database runs. APEX is also offered on Oracle's Cloud across various services including Autonomous Database Cloud Services and the stand-alone fully managed APEX Application Development service. ^[3]

Oracle APEX has had many name changes since its inception in 2000, including:

• Flows ^[4]
• Oracle Platform ^[5]
• Project Marvel
• HTML DB ^[6]
• Application Express (APEX) aka Oracle APEX ^[7]

APEX was created by Mike Hichwa a developer at Oracle, after the development of his previous project, WebDB, started to diverge from his original vision. Although APEX shares some functionality with Web DB, it was developed from scratch, and there's no upgrade path from Web DB to APEX. When tasked with building an internal web calendar, Hichwa enlisted the help of Joel Kallman and started development on a project called Flows. Hichwa and Kallman co-developed the Web Calendar and Flows, adding features to Flows as they needed them to develop the calendar. Early builds of Flow had no front-end, so all changes to an application had to be made in SQL*Plus via inserts, updates and deletes. ^[8]

APEX is extensively used internally by Oracle to develop its support sites.^{[ citation needed ]} The AskTom knowledge base, online store, Dev Gym, and livesql run on APEX.^{[ citation needed ]}

With version 5.2, the numbering was changed to 18.1, indicating the year and quarter of release. This change is associated with Oracle's new numbering nomenclature. The latest version of the Oracle APEX application is 23.2 and was released on November 14, 2023. ^[9]

Low-code environment

While APEX has existed since 2004 in one form or another, it has recently^{[ when? ]} been included in a new category of application development platforms called low-code. These low-code environments can trace their origins to 4GL programming languages and rapid application development (RAD) tools. ^[10] Since APEX was originally marketed as a RAD tool, this progression is a logical one. APEX allows building web applications with no-code. When the requirements are more complex, APEX allows the extension of the Low-Code objects through a declarative framework. This framework lets the developer define custom logic, business rule, and user interfaces. The developer can do this through the inclusion of SQL, PL/SQL, HTML, JavaScript, or CSS as well as APEX plug-ins. APEX permits developers to go from no-code to low-code to more code. ^{[11] [12]}

Security

There is a common misconception^{[ vague ]} that the abstracted nature of APEX applications results in a relatively secure user environment. However, APEX applications suffer from the same classes of application security flaws as other web applications based on more direct technologies such as PHP, ASP.net and Java.

The main classes of vulnerability that affect APEX applications are: SQL injection, Cross-site scripting (XSS), and Access Control.

APEX applications inherently use PL/SQL constructs as the base server-side language. As well as accessing data via PL/SQL blocks, an APEX application will use PL/SQL to implement authorization and to conditionally display web page elements. This means that generally APEX applications suffer from SQL injection when these PL/SQL blocks do not correctly validate and handle malicious user input. Oracle implemented a special variable type for APEX called Substitution Variables (with a syntax of &NAME) and these are not safe and lead to SQL Injection. Where the injection occurs within a PL/SQL block an attacker can inject an arbitrary number of queries or statements to execute. Escaping special characters and using bind variables is the right way to code to ensure no XSS and SQL injection.

Cross-Site Scripting vulnerabilities arise in APEX applications just like other web application languages. Oracle provides the htf.escape_sc() function to escape user data that is displayed within a rendered HTML response. The reports that APEX generates also provide protection against XSS through the Display As setting on report columns. Originally the default was for reports to be created without any escaping of the columns, although recent versions now set the column type to escape by default. Column definitions can be queried programmatically to check for columns that do not escape the value.

To control access to resources within an APEX application a developer can assign authorization schemes to resources (such as pages and items). These must be applied consistently in order to ensure that resources are appropriately protected. A typical example of inconsistent access-control being applied is where an authorization scheme is set for a Button item, but not the associated Process that is performed when the button is clicked. A malicious user can perform the process (through JavaScript) without requiring the actual Button to be accessible.

Since APEX 4.0, the Application Builder interface provides some limited assessment of the security posture through the Advisor utility.

Third-party libraries

Developers may improve and extend their APEX applications by using third-party libraries. Among them are jQuery Mobile (HTML5-based user interface), ^[13] JQuery UI (user interface for the web), ^[14] AnyChart (JavaScript/HTML5 charts), ^[15] CKEditor (web text editor) ^[16] and others. Experts^{[ who? ]} say it is an advantage of applying the latest APEX patches that the external libraries that come with APEX carry an update, too.^{[ clarification needed ]} However, many of the libraries come out with newer versions more frequently than there are APEX patches. ^{[17] [18]}

APEX and Oracle Database Express Edition (XE)

Oracle APEX can be run inside Oracle Database Express Edition (XE), a free entry-level database. Although the functionality of APEX isn't intentionally limited when running on XE, the limitations of the database engine may prevent some APEX features from functioning. Also, Oracle XE has limits for CPU, memory and disk usage. ^[19]

See also

• Oracle SQL Developer
• Jam.py

References

1. "Oracle Application Express - Downloads". Oracle. Retrieved December 10, 2015.
2. "Oracle Application Express Documentation". Oracle Help Center.
3. "Oracle Application Express (APEX): Overview" (PDF). Oracle Corporation .
4. "Welcome to Flows for APEX". apex-flowsforapex. Retrieved September 24, 2021.
5. "Implementing Oracle API Platform Cloud Service". Packt. Retrieved September 24, 2021.
6. "1 What is Oracle HTML DB?". docs.oracle.com. Retrieved September 24, 2021.
7. "Apex Developer | Limestone Digital". limestonedigital.com. September 3, 2021. Retrieved September 24, 2021.
8. "Michael Hichwa". Apress. Michael Hichwa is the original developer and architect of Oracle Application Express (APEX), aka HTML DB. Michael created APEX as a 100% rewrite of an earlier browser-based application development tool he also created, called Oracle WebDB. He had invaluable technical assistance and guidance from Tom Kyte and the addition of Joel Kallman as a co-developer. Michael and Joel have led APEX development efforts since 1999
9. "Oracle APEX Downloads". oracle.com. Retrieved March 20, 2024.
10. Baranouski, Artsiom (February 21, 2023). "What is ERP Software Development Process: A Guide to Better Enterprise". Medium. Retrieved March 12, 2023.
11. Kallman, Joel. "From Low Code to High Control" . Retrieved November 27, 2017.
12. "Low Code with Oracle Application Express". apex.oracle.com. Retrieved November 27, 2017.
13. "Building a Mobile Web Application Using Oracle Application Express 5.0". Oracle.
14. "Application Express Application Builder User's Guide". Oracle.
15. "Oracle APEX: Using AnyChart products with Oracle Application Express (APEX)". AnyChart.
16. "Oracle chooses FCKeditor for Application Express". CKEditor.com.
17. "Goodies - APEX 4.2.2 included Libraries". Dimitri Gielis Blog. May 8, 2013. Retrieved December 10, 2015.
18. "APEX 5 first peek". Grassroots Oracle. March 17, 2014. Retrieved December 10, 2015.
19. "Limitations of the Express Edition". Oracle Corporation. Retrieved May 22, 2013.

Bibliography

• Beckmann, Ralf (October 1, 2013), Oracle Application Express in der Praxis: Mit APEX datenbankbasierte Webanwendungen entwickeln (1st ed.), Carl Hanser Verlag, p. 416, ISBN   978-3446438965
• Cimolini, Patrick (September 12, 2011), Agile Oracle Application Express (1st ed.), Apress, p. 200, ISBN   978-1-4302-3759-4
• Mattamal, Raj; Nielsen, Anton (July 28, 2011), Expert Oracle Application Express Plugins: Building Reusable Components (1st ed.), Apress, p. 300, ISBN   978-1-4302-3503-3
• Fox, Tim; Scott, John; Spendolini, Scott (June 29, 2011), Pro Oracle Application Express 4 (2 ed.), Apress, p. 700, ISBN   978-1-4302-3494-4
• Zehoo, Edmund (June 15, 2011), Oracle Application Express 4 Recipes (1st ed.), Apress, p. 300, ISBN   978-1-4302-3506-4
• Lancaster, Mark (May 28, 2011), Oracle Application Express 4.0 with Ext JS (1st ed.), Packt Publishing, p. 392, ISBN   978-1-84968-106-3
• Aust, Dietmar; D'Souza, Martin Giffy; Gault, Doug; Gielis, Dimitri; Hartman, Roel; Hichwa, Michael; Kennedy, Sharon; Kubicek, Denes; Mattamal, Raj; McGhan, Dan; Mignault, Francis; Nielsen, Anton; Scott, John (May 16, 2011), Expert Oracle Application Express (1st ed.), Apress, p. 500, ISBN   978-1-4302-3512-5
• Gault, Doug; Cannell, Karen; Cimolini, Patrick; D'Souza, Martin Giffy; Hilaire, Timothy St. (March 31, 2011), Beginning Oracle Application Express 4 (1st ed.), Apress, p. 440, ISBN   978-1-84968-134-6
• van Zoest, M.; van der Plas, Marcel (December 14, 2010), Oracle APEX 4.0 Cookbook (1st ed.), Packt Publishing, p. 328, ISBN   978-1-4302-3147-9
• Geller, Arie; Lyon, Matthew (June 1, 2010), Oracle Application Express 3.2 – The Essentials and More (1st ed.), Packt Publishing, p. 520, ISBN   978-1-84719-452-7
• van den Bos, Douwe Pieter (July 29, 2009), Oracle Application Express Forms Converter (1st ed.), Packt Publishing, p. 172, ISBN   978-1-84719-776-4
• Greenwald, Rick (December 22, 2008), Beginning Oracle Application Express (1st ed.), Wrox, p. 384, ISBN   978-0-470-38837-2
• Scott, John; Spendolini, Scott (September 16, 2008), Pro Oracle Application Express (1st ed.), Apress, p.  700, ISBN   978-1-59059-827-6

External links

• Official website