Using the Database To Do Too Much - Implementing Database Security and Auditing - page 215

make them reusable functional elements that should be exposed to any pro-
gram that can make an HTTP request. A lot of hard work is involved in
making published APIs that are stable, robust, and secure. Taking existing
procedures and making them callable from the Web does not ensure all of
these things.
Two Apache modules are delivered with the Oracle HTTP Server and
used to extend the Web server with functions that run within the Oracle
database:

mod_plsql (The Oracle PL/SQL Toolkit). Allows you to directly exe-
cute stored procedures through Web server calls.

mod_ose (The Oracle Servlet Engine). Allows you to call Java servlets
that are stored and executed in the database.

7.2.1 Mod_plsql

mod_plsql is a dangerous option, and you should be aware of the issues
before you decide to use it. Unfortunately, even if you have not thought
about this issue, the default installation will have activated this feature for
you—and with fairly broad access privileges. Modules are loaded through
the Apache configuration files. In $ORACLE_HOME/Apache/Apache/conf , you
have a file called httpd.conf —Apache's main configuration file. At the very
end, the Oracle-specific configuration file is included, which in turn
includes the plsql configuration file.
In httpd.conf :

# Include the Oracle configuration file for custom settings
include "C:\oracle\ora92\Apache\Apache\conf\ oracle_apache.conf "

which includes Oracle modules, including mod_plsql.
In oracle_apache.conf :

# Advanced Queuing - AQ XML
include "C:\oracle\ora92\rdbms\demo\aqxml.conf"
#
#
include "C:\oracle\ora92\xdk\admin\xml.conf"
#
include "C:\oracle\ora92\Apache\modplsql\cfg\ plsql.conf "
include "C:\oracle\ora92\Apache\jsp\conf\ojsp.conf"