The Database Hacker's Handbook: Defending Database Servers

PL/SQL and Oracle Application Server

PL/SQL procedures can be executed over the Web via Oracle Application Server. In fact, it's one of the more common application environments used for Oracle-based web applications. When using a PL/SQL-based web application, essentially the web server is working simply as a proxy server. It receives requests from clients and passes these to the backend database server for execution. The results are passed back to the web server, which then passes it on to the client.

For example, assume there's a bookstore that uses PL/SQL for its e-Commerce site. The store might create several packages, one for browsing for books and another for purchasing. Assume the package that allows book browsing is called BROWSE and it exports a number of procedures such as SEARCH_BY_AUTHOR, SEARCH_BY_TITLE, and so on. To search for books by a given author, users of the web application would request in their web browser the following URL:

http://www.books.example.com/pls/bookstore/browse.search_by_author?p_author=Dickens

Let's break this down:

www.books.example.com is the web site. The /pls indicates that this is a request for a PL/SQL application. A handler is defined for this in the apache configuration files. /bookstore is the DAD or Database Access Descriptor. This DAD points to a location of a configuration file that contains details of how the web server is to connect to the database server. This information includes things like the username and password with which ...