21.2.6 About Securing File Uploads
Learn about developer best practices for securing file uploads.
Oracle APEX enables you to easily build an application that can be used to upload files and to
access uploaded files. These files are uploaded into a common file storage table.
Although the database view APEX_APPLICATION_FILES
shows those files
associated with your database account (or workspace), programmatic access to the common
file storage table does not always require authentication, enabling other users to see
your uploaded files. For this reason, Oracle recommends that developers use the methods
described in Understanding BLOB Support in Forms and Reports, with the files being uploaded directly to a table in your workspace
schema, or if you need programmatic access, uploaded to
APEX_APPLICATION_TEMP_FILES
. When you use the built-in methods of
file access, the authorization checks on the page also apply to file access. Storing
uploaded files in a table in your workspace schema also gives you more control over the
underlying database storage. For example, you can use DDL operations, such as TRUNCATE
and LOB segment move, to reclaim unused storage.
Note:
The database viewAPEX_APPLICATION_FILES
supports INSERT, UPDATE, and DELETE DML
operations. The database view APEX_APPLICATION_TEMP_FILES
supports
DELETE DML operations. You can perform these operations as part of your application or
within the context of your workspace, for example in SQL Commands within SQL
Workshop.
See Also:
- About the Differences Between Page Items and Application Items
- File Upload to learn more about creating a File Browse page item
Parent topic: Understanding Developer Security Best Practices