Safety Tips for SQL Injection in Oracle APEX

There are some safety tips to save your APEX Application from SQL Injection
Use bind arguments  
   Parameterize queries using bind arguments. Not only do bind arguments eliminate the possibility of SQL injection, but they also enhance performance

Avoid Dynamic SQL with concatenated input.

                     E.g.: EXECUTE IMMEDIATE 'DROP TABLE ' || 'emp_' || loc;

                     Filter and sanitize input

 Number of functions that can be used to sanitize user input and to guard against SQL injection in applications that use dynamic SQL 

Reduce Attack Surface

 Ensure that all excess DB privileges are revoked and that only routines intended for end-user access are exposed. 

   

Note

Put intelligent field-character limits and data types on input fields.

Don’t disable the ‘escape special characters’ settings in APEX fields.

If you must escape special characters, use the

                             APEX_ESCAPE.HTML_WHITELIST();

                             function.