Oracle Forms and PL/SQL secure coding¶

Oracle Forms applications combine UI logic, PL/SQL and configuration. Security review is most useful when the relevant code is available as readable Forms exports or PL/SQL source. Examples include .fmt, .pld, .sql, package specifications and package bodies. Do not assume a binary .fmb or .pll file provides equivalent source visibility.

Bind dynamic SQL values¶

The following statements belong inside a PL/SQL procedure where p_code is an input string and v_name is a compatible local string variable. The fictional demo_customers table has a unique customer code.

Unsafe: combine the code with SQL text.

EXECUTE IMMEDIATE
    'SELECT name FROM demo_customers WHERE code = ''' || p_code || ''''
    INTO v_name;

Safer: bind the value through USING.

EXECUTE IMMEDIATE
    'SELECT name FROM demo_customers WHERE code = :code'
    INTO v_name
    USING p_code;

The placeholder belongs to the statement and its value is supplied separately. If the statement structure is constant, ordinary static SQL is usually simpler than dynamic SQL. Oracle's SQL injection guidance for PL/SQL explains binding and the risks of concatenation.

Identifiers are different from values. Do not let a request choose arbitrary table or column names; map a justified choice to a fixed identifier. Review definer versus invoker rights for the procedure and grant only necessary database privileges. Catch expected exceptions deliberately; WHEN OTHERS THEN NULL can hide failed security checks or incomplete operations. The native dynamic SQL documentation describes the execution model.

Check the fix¶

In a disposable schema, create a customer code containing an apostrophe, such as DEMO'O1. Confirm that the safer query returns exactly its name and that an unknown code follows your explicit NO_DATA_FOUND handling. No real customer records or production credentials are required.

Supply relevant package bodies, triggers and configuration for a review while excluding secrets. Preserve source paths so findings can be traced to the original code. Continue with SQL injection, hardcoded passwords and empty catch blocks.

Export formats, installed analyzers and project configuration affect what can be analyzed. This guide does not promise direct parsing of every Oracle binary artifact or comprehensive application coverage.