Hacker News Reader

Apex is nice, but it becomes hard to maintain larger applications.

It also makes it so easy to create opportunities for SQL injection if you don't have careful coders. And it is also a great target for DoS attacks.

Having said all this, it really is the only low code platform I would ever consider using, in spite of it being Oracle's.

View on HN

> It also makes it so easy to create opportunities for SQL injection if you don't have careful coders.

This is not the case. If you bind values with :ITEM_NAME and use compiled statements (never dynamic string concatenated ones with "execute immediate') there is no chance of SQL injection.

You can set items from the URL, which you usually can't do with most web frameworks. Of course you can enable Session State Protection, but you have to be vigilant.

You can also inadvertently leave a page public.

Reply on news.ycombinator.com