| Oracle APEX | |
|---|---|
 | |
| Developer | Oracle Corporation |
| Stable release | 24.2 / January 15, 2025 (2025-01-15) |
| Operating system | Windows,Linux, Oracle Solaris, HP-UX, IBM AIX[1] |
| License | Oracle Technical Network License (proprietary[2]) |
| Website | apex |
Oracle APEX (Oracle Application Express) is alow-code application development platform developed byOracle Corporation. APEX is used for developing and deployingcloud,mobile and desktopapplications. It has a web-basedintegrated development environment (IDE) that includes tools such aswizards,drag-and-drop layout builders, and property editors.
APEX is a feature of theOracle Database. It is a part of theOracle Cloud within the Autonomous Database Cloud Services and the stand-alone APEX Application Development service.[3]
Oracle APEX has had name changes since its creation in 2000, including:
APEX was created by Oracle developer Michael Hichwa following his earlier project, WebDB. While building an internalweb calendar, Hichwa collaborated with fellow Oracle employee Joel Kallman to develop Flows. Together, they co-developed the web calendar, adding features to Flows as they needed them to develop the calendar. Early builds of Flows had no front-end, so all changes to an application were made inSQL Plus via insert, update and delete commands.[8]
With version 5.2, the numbering system was changed to align with the year and quarter of the release, renaming it to 18.1. This change is consistent with Oracle's change in numbering nomenclature.
Oracle APEX is a low-code development platform, a type of environment that can trace their origins tofourth-generation programming languages andrapid application development (RAD) tools.
APEX allows users to buildweb applications with a "no code" graphical user interface. However, when the requirements are more complex, APEX allows the extension of the low-code objects through a declarative framework. This framework lets the developer define custom logic, business rules, and user interfaces. The developer can do this through the inclusion ofSQL,PL/SQL,HTML,JavaScript, orCSS as well as APEX plug-ins.[9][10]
 | This articleneeds additional citations forverification. Please helpimprove this article byadding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Oracle Application Express" – news ·newspapers ·books ·scholar ·JSTOR(October 2024) (Learn how and when to remove this message) |
APEX applications are subject to the same level ofapplication security risks as other web-based applications built on more direct technologies such asPHP,ASP.NET andJava. However, since APEX 4.0, the Application Builder interface has included a utility called Advisor, which provides a basic assessment of an application’s security posture.
The two main vulnerabilities that affect APEX applications areSQL injection andcross-site scripting (XSS).[11]
SQL Injection
APEX applications inherently use PL/SQL constructs as the baseserver-side language and access data via PL/SQL blocks.[12] An APEX application will use PL/SQL to implement authorization and to conditionally display web page elements. Because of this, APEX applications can suffer from an SQL injection when these PL/SQL blocks do not correctly validate and handlemalicious user input.[13]
Oracle implemented a special variable type for APEX calledSubstitution Variables (with a syntax of "&NAME."); however, these are insecure and can lead to SQL injections. When an injection occurs within a PL/SQL block, an attacker can inject an arbitrary number of queries or statements to execute. Escaping special characters and using bind variables can reduce, but not remove, XSS and SQL injection vulnerabilities.
Cross-Site Scripting (XSS)
XSS vulnerabilities arise in APEX applications just like in otherweb application languages. To counteract this, Oracle provides the htf.escape_sc() function to replace literal characters with HTML entity names and avoid undesired behaviors.[14]
A developer can use authorization schemes to manage access to resources like pages and items within an APEX application. To ensure proper security, these schemes must be consistently applied across all relevant resources. An example of inconsistent access control arises when an authorization scheme is applied to a button item but not to the process linked to that button. This inconsistency could allow a user to trigger the process directly via JavaScript, bypassing the button entirely.
Developers may improve and extend APEX applications by using third-party libraries. Among them areJQuery Mobile (HTML 5-based user interface),[15]JQuery UI (user interface for the web),[16]AnyChart (JavaScript/HTML 5 charts),[17]CKEditor (web text editor),[18] and others. Oracle claims that applying the latest APEX patches ensures that the external libraries bundled with the platform are updated in tandem, which theoretically enhances application stability and security.[19] However, many of the libraries are updated more frequently than APEX patches are released, requiring developers to monitor and manually apply updates as necessary to maintain compatibility and security.[20][21]
Oracle APEX can be run inside Oracle Database Express Edition (XE), a free entry-level database. Although the functionality of APEX isn't intentionally limited when running on XE, the limitations of the database engine may prevent some APEX features from functioning. Furthermore, Oracle XE has limits forCPU, memory, and disk usage.[22]
Michael Hichwa is the original developer and architect of Oracle Application Express (APEX), aka HTML DB. Michael created APEX as a 100% rewrite of an earlier browser-based application development tool he also created, called Oracle WebDB. He had invaluable technical assistance and guidance from Tom Kyte and the addition of Joel Kallman as a co-developer. Michael and Joel have led APEX development efforts since 1999
