Using the Database To Do Too Much - Implementing Database Security and Auditing - page 219

tion-server architectures will now be introduced into DBA and application
developer access. Finally, to make matters even worse, iSQL*Plus has a vul-
nerability reported in Oracle Security Alert #46 relevant to Oracle 9i
Releases 1 and 2 (9.0.x, 9.2.0.1, and 9.2.0.2). You can download a patch for
this problem (bug 2581911).

7.3 Don't generate HTML from within your

stored procedures

Mod_plsql offers several packages to help you respond to HTTP requests
and write HTML pages, including the following:

HTP. Including procedures for writing HTTP responses

HTF. Including functions for querying HTTP requests

OWA_COOKIE. Including procedures that help you manage cook-
ies

OWA_UTIL. Utility procedures

It is simple to write a procedure that generates and returns HTML pages
when called through mod_plsql. For example, a Hello World program
using mod_plsql that also sets a cookie valid for a day would look like:

CREATE OR REPLACE PROCEDURE HelloWorld AS
BEGIN
OWA_UTIL.MIME_HEADER('text/html', FALSE);
OWA_COOKIE.SEND(cookieId, sessionId, sysdate+1);
HTP.HTITLE('Hello World');
HTP.PRINT('Hello mod_plsql');
HTP.LINE;
OWA_UTIL.HTTP_HEADER_CLOSE;
END;

In addition, a feature called PL/SQL Server Pages (PSPs) enables you to
develop Web pages with dynamic content. They are an alternative to coding
a stored procedure that writes out the HTML code for a web page—like the
difference between Java Server Pages (JSPs) and Java servlets.
Using special tags, you can embed PL/SQL scripts into HTML source
code. The scripts are executed when the pages are requested by Web clients