Oracle Application Express
This article contains wording that promotes the subject in a subjective manner without imparting real information. (August 2021) |
Developer(s) | Oracle Corporation |
---|---|
Stable release | 21.1.0
/ May 12, 2021 |
Operating system | Windows, Linux, Oracle Solaris, HP-UX, IBM AIX[1] |
Type | Oracle database development environment |
License | Oracle Technical Network License (proprietary[2]) |
Website | apex |
Oracle APEX (also known as APEX or Oracle Application Express) is a proprietary web-based integrated development environment (IDE) developed by Oracle Corporation for creating and managing Oracle databases and other related database functionality. APEX intends to simplify the process of creating web applications that serve as a frontend to a database server, among other things.
APEX comes included in the core install of Oracle's database products and is also offered as a managed service as part of the Oracle Cloud Platform. The product was renamed from Oracle HTML DB in 2006.
Releases[]
Oracle APEX can be installed on any Oracle database from version 9.2 or higher, and starting from Oracle 11g it is installed with the database by default. APEX 4.0 and higher can be installed on an Oracle 10.2.0.3 or higher database. APEX 5.0 and higher can be installed on all editions (SE1, SE, and EE) of the Oracle database, 11.1.0.7 or higher with a valid Oracle Database Technical Support agreement; From APEX 18.1, the minimum database version is 11.2.0.4. It can also be used with Oracle Database 11g Express Edition (XE), but is supported through the Oracle Technology Network discussion forum, and not through Oracle Support Services.[1]
Product Name | Version | Released | showNotes |
---|
Background[]
Oracle APEX has gone through many name changes since its inception in 2000. Names include:
- Flows
- Oracle Platform
- Project Marvel
- HTML DB
- Application Express (APEX) aka Oracle APEX
APEX was created by Mike Hichwa, a developer at Oracle, after development of his previous project, Web DB, started to diverge from his original vision. Although APEX shares some functionality with Web DB, it was developed from scratch and there's no upgrade path from Web DB to APEX. When tasked with building an internal web calendar, Hichwa enlisted the help of Joel Kallman and started development on a project called Flows. Hichwa and Kallman co-developed the Web Calendar and Flows, adding features to Flows as they needed them to develop the calendar. Early builds of Flow had no front-end so all changes to an application had to be made in SQL*Plus via inserts, updates and deletes.[14]
APEX is extensively used internally by Oracle to develop its support sites. The AskTom knowledgebase, online store, Dev Gym, and livesql run on APEX.
Advantages and disadvantages[]
This section contains a pro and con list, which is sometimes inappropriate. (October 2015) |
Advantages[]
- DBAs familiar with PL/SQL can use their skill set to develop web applications
- Easy to create mock-ups using pre-built themes
- Easy to deploy (end user opens a URL to access an APEX application)
- Scalable (can be deployed to laptops, stand-alone servers, or Oracle RAC installations)
- Server-side processing and validations
- Basic support for group development
- Free hosting of demo applications provided by Oracle
- APEX applications can run on the free Oracle Express Edition (XE) database
- Individual components of an application can be retrieved or identified using SQL, facilitating customized reports
- Easily adheres to the SQA development/test/production model (while not exposing DB passwords)
- Helps put the focus on the DB model supporting a solution (versus coding in Java, .NET or PHP - you only need JavaScript)
- Easily supports a standardized theme across application sets (and the changing of that theme)
- Easily integrates with different datasources such as local database, remote Oracle database, or any web service
- Semi-technical end users can build their own web pages and reports
Disadvantages[]
- APEX applications are created using Oracle's own tools and only can be hosted in an Oracle database, making an implementer susceptible to vendor lock-in.
- Very few webhosts offer APEX (Oracle Database) on their hosting service package (most of them offer PHP + MySQL or ASP + Microsoft SQL Server). As a result, APEX applications are limited in their choice of webhosts. However, since APEX can run on the free Express Edition of the Oracle database (Oracle XE), it is possible to install the required stack (database, APEX framework, and web gateway) on any standard operating system host (Linux or Windows).
- Projects requiring multiple developers to touch the same web page will need to communicate their intentions with each other. There is no built in version control and all components must be edited through the web interface. No support for merge two versions. Page locking can help guard against conflicts.
Low Code environment[]
While APEX has existed since 2004 in one form or another, it has recently been included in the new category of application development platforms called Low Code. These Low Code environments can trace their origins to 4GL programming languages and rapid application development(RAD) tools. Since APEX was originally marketed as a RAD tool, this progression is a logical one. APEX allows the easy building of web applications with no code. Where the requirements are more complex, APEX allows the extension of the Low Code objects through a declarative framework. This framework lets the developer define custom logic and business rules as well as create an enhanced user interface. The developer can do this through the inclusion of SQL, PL/SQL, HTML, JavaScript, or CSS as well as APEX plug-ins. So APEX permits developers to go from no code to low code to more code.[15][16]
Security[]
This section does not cite any sources. (October 2015) |
There is a common misconception that the abstracted nature of APEX applications results in a relatively secure user environment. However, APEX applications suffer from the same classes of application security flaws as other web applications based on more direct technologies such as PHP, ASP.net and Java.
The main classes of vulnerability that affect APEX applications are: SQL injection, Cross-site scripting (XSS), and Access Control.
APEX applications inherently use PL/SQL constructs as the base server-side language. As well as accessing data via PL/SQL blocks, an APEX application will use PL/SQL to implement authorization, and to conditionally display web page elements. This means that generally APEX applications suffer from SQL injection when these PL/SQL blocks do not correctly validate and handle malicious user input. Oracle implemented a special variable type for APEX called Substitution Variables (with a syntax of &NAME.) and these are not safe and lead to SQL Injection. Where the injection occurs within a PL/SQL block an attacker can inject an arbitrary number of queries or statements to execute. Escaping special characters and using bind variables is the right way to code to ensure no XSS and SQL injection.
Cross-Site Scripting vulnerabilities arise in APEX applications just like other web application languages. Oracle provides the htf.escape_sc() function to escape user data that is displayed within a rendered HTML response. The reports that APEX generates also provide protection against XSS through the Display As setting on report columns. Originally the default was for reports to be created without any escaping of the columns, although recent versions now set the column type to escape by default. Column definitions can be queried programmatically to check for columns that do not escape the value.
To control access to resources within an APEX application a developer can assign authorization schemes to resources (such as pages and items). These must be applied consistently in order to ensure that resources are appropriately protected. A typical example of inconsistent access-control being applied is where an authorization scheme is set for a Button item, but not the associated Process that is performed when the button is clicked. A malicious user can perform the process (through JavaScript) without requiring the actual Button to be accessible.
Since APEX 4.0, the Application Builder interface provides some limited assessment of the security posture through the Advisor utility.
Third-party libraries[]
Developers may improve and extend their APEX applications by using third-party libraries that APEX comes standard with. Among them are jQuery Mobile (HTML5 based user interface),[17] jQuery UI (user interface for the web),[18] AnyChart (JavaScript/HTML5 charts),[19] CKEditor (web text editor),[20] and others. Experts[citation needed] say it is an advantage of applying the latest APEX patches that the external libraries which come with APEX carry an update, too. However, many of the libraries come out with newer versions more frequently than there are APEX patches.[21][22]
APEX and Oracle Database Express Edition (XE)[]
Oracle APEX can be run inside Oracle Database Express Edition (XE), a free entry-level database. Although the functionality of APEX isn't intentionally limited when running on XE, the limitations of the database engine may prevent some APEX features from functioning. Also, Oracle XE has limits for CPU, memory and disk usage.[23]
APEX and Oracle Autonomous Database[]
With Oracle APEX and Autonomous Database, the configuration, patching, monitoring, and upgrading of all Oracle APEX components is fully managed by Oracle. Developers can therefore focus on application development and deployment without any hassles of upkeep or manual maintenance. The feature functionality includes Oracle SQL Developer Web (Database Actions), Oracle REST Data Services (ORDS), Oracle XML DB features, Spatial and more.[24]
APEX Service[]
Oracle APEX Application Development, also known as APEX Service is a fully managed low-code application development and deployment platform in Oracle Cloud Infrastructure (OCI).[25] With this service, developers get APEX and an underlying Oracle Autonomous Database. This service also includes SQL Developer Web (Database Actions) for database actions and Oracle REST Data Services (ORDS).
See also[]
References[]
- ^ Jump up to: a b c d e "Oracle Application Express - Downloads". Oracle. Retrieved 2015-12-10.
- ^ "Oracle Application Express Documentation". Oracle Help Center.
- ^ Jump up to: a b c d e f g h "APEX Overview". Oracle Corporation. Retrieved September 16, 2012.
- ^ "Oracle APEX 5.0 released today". Dimitri Gielis Blog. April 15, 2015. Retrieved December 10, 2015.
- ^ "Oracle APEX 5.0.1 now available". Inside Oracle APEX by Patrick Wolf. July 16, 2015. Retrieved December 10, 2015.
- ^ "Oracle Application Express Patch Set Notes". Oracle. Retrieved December 10, 2015.
- ^ "Apex 5.0.2 was released". Proactive Support - Oracle Development Tools. October 22, 2015. Retrieved December 10, 2015.
- ^ "Apex 5.0.3 was released". Proactive Support - Oracle Development Tools. December 15, 2015. Retrieved December 10, 2015.
- ^ "Oracle® Application Express Patch Set Notes". www.oracle.com. Retrieved 2016-07-25.
- ^ "Oracle® Application Express 5.1.1 Patch Set Notes". www.oracle.com. Retrieved 2017-03-28.
- ^ "Oracle Application Express 5.1.2 Patch Set Notes". www.oracle.com. Retrieved 2017-07-27.
- ^ "Oracle Application Express 5.1.4 Patch Set Notes". www.oracle.com. Retrieved 2017-12-17.
- ^ https://easyoradba.com/2018/05/28/upgrade-oracle-apex-from-5-1-x-to-18-1. Missing or empty
|title=
(help) - ^ "Michael Hichwa". Apress.
Michael Hichwa is the original developer and architect of Oracle Application Express (APEX), aka HTML DB. Michael created APEX as a 100% rewrite of an earlier browser-based application development tool he also created, called Oracle WebDB. He had invaluable technical assistance and guidance from Tom Kyte and the addition of Joel Kallman as a co-developer. Michael and Joel have led APEX developments efforts since 1999
- ^ Kallman, Joel. "From Low Code to High Control". Retrieved 2017-11-27.
- ^ "Low Code with Oracle Application Express". apex.oracle.com. Retrieved 2017-11-27.
- ^ "Building a Mobile Web Application Using Oracle Application Express 5.0". Oracle.
- ^ "Application Express Application Builder User's Guide". Oracle.
- ^ "Oracle APEX: Using AnyChart products with Oracle Application Express (APEX)". AnyChart.
- ^ "Oracle chooses FCKeditor for Application Express". CKEditor.com.
- ^ "Goodies - APEX 4.2.2 included Libraries". Dimitri Gielis Blog. May 8, 2013. Retrieved December 10, 2015.
- ^ "APEX 5 first peek". Grassroots Oracle. March 17, 2014. Retrieved December 10, 2015.
- ^ "Limitations of the Express Edition". Oracle Corporation. Retrieved May 22, 2013.
- ^ "Oracle APEX on Autonomous Database".
- ^ "Oracle APEX Application Development".
Bibliography[]
- Beckmann, Ralf (October 1, 2013), Oracle Application Express in der Praxis: Mit APEX datenbankbasierte Webanwendungen entwickeln (1st ed.), Carl Hanser Verlag, p. 416, ISBN 978-3446438965
- Cimolini, Patrick (September 12, 2011), Agile Oracle Application Express (1st ed.), Apress, p. 200, ISBN 978-1-4302-3759-4
- Mattamal, Raj; Nielsen, Anton (July 28, 2011), Expert Oracle Application Express Plugins: Building Reusable Components (1st ed.), Apress, p. 300, ISBN 978-1-4302-3503-3
- Fox, Tim; Scott, John; Spendolini, Scott (June 29, 2011), Pro Oracle Application Express 4 (2 ed.), Apress, p. 700, ISBN 978-1-4302-3494-4
- Zehoo, Edmund (June 15, 2011), Oracle Application Express 4 Recipes (1st ed.), Apress, p. 300, ISBN 978-1-4302-3506-4
- Lancaster, Mark (May 28, 2011), Oracle Application Express 4.0 with Ext JS (1st ed.), Packt Publishing, p. 392, ISBN 978-1-84968-106-3
- Aust, Dietmar; D'Souza, Martin Giffy; Gault, Doug; Gielis, Dimitri; Hartman, Roel; Hichwa, Michael; Kennedy, Sharon; Kubicek, Denes; Mattamal, Raj; McGhan, Dan; Mignault, Francis; Nielsen, Anton; Scott, John (May 16, 2011), Expert Oracle Application Express (1st ed.), Apress, p. 500, ISBN 978-1-4302-3512-5
- Gault, Doug; Cannell, Karen; Cimolini, Patrick; D'Souza, Martin Giffy; Hilaire, Timothy St. (March 31, 2011), Beginning Oracle Application Express 4 (1st ed.), Apress, p. 440, ISBN 978-1-84968-134-6
- van Zoest, M.; van der Plas, Marcel (December 14, 2010), Oracle APEX 4.0 Cookbook (1st ed.), Packt Publishing, p. 328, ISBN 978-1-4302-3147-9
- Geller, Arie; Lyon, Matthew (June 1, 2010), Oracle Application Express 3.2 – The Essentials and More (1st ed.), Packt Publishing, p. 520, ISBN 978-1-84719-452-7
- van den Bos, Douwe Pieter (July 29, 2009), Oracle Application Express Forms Converter (1st ed.), Packt Publishing, p. 172, ISBN 978-1-84719-776-4
- Greenwald, Rick (December 22, 2008), Beginning Oracle Application Express (1st ed.), Wrox, p. 384, ISBN 978-0-470-38837-2
- Scott, John; Spendolini, Scott (September 16, 2008), Pro Oracle Application Express (1st ed.), Apress, p. 700, ISBN 978-1-59059-827-6
External links[]
- Official website
- Oracle APEX Documentation
- Oracle APEX Discussions
- Oracle APEX Ideas and Feature Requests
- APEX World - Oracle Application Express Community site
- Sites built with Oracle APEX
- Oracle APEX Plugins built by the developer community
- APEX GitHub repository contains starter apps and sample code
- Oracle Application Express Translations created by the APEX community
- Question & Answer Forum for Developers
- Oracle software
- Freeware
- 2004 software
- Web frameworks