لطفا منتظر باشید ...
Best Practices
In this chapter you have seen several techniques that can be used to put together XML-enabled applications. The common theme is that whether you use the Pipeline Processor, JSPs, or the XSQL Servlet, the code is almost entirely declarative. This is distinctly different from normal compiled and linked applications in that the code can be changed, customized, or updated at any time. This approach has the advantage of allowing you to develop generic, high-quality, reusable components that can be easily put together in the same way that integrated circuits simplified and improved electronic circuit design over discrete transistors.
Creating a More Secure Connection
In most applications, you will use the XSQL Servlet to connect to a database. The XSQLConfig.xml file must be kept secure on the server. This file should never be in any directory tree that is mapped to a virtual path of your web server. You should set up an account that owns your servlet engine for your application and make sure that only this account has read permissions on the file.It is also important that you control the parameters passed by the URL into the XSQL Servlet. By default, it will accept a stylesheet using the xml-sytlesheet parameter unless you add the attribute allow-client-style="no" to the document element of your page.Finally, you saw how to use lexical substitution of variables into SQL queries. This is a common feature of many Oracle products. It is also potentially a dangerous one. Therefore, you can guard against abuses by limiting the scope of database access permitted to users of your application. You can also bind variables (as shown in the “Using JSPs and XSQL Pages” section) or, even better, perform the entire database transaction in a custom action handler call.
When You Need Simple JSP XML Functionality
Besides all of this powerful XML functionality provided by the XDK, Oracle does supply an XML JSP tag library with its OC4J J2EE container. This library is called xml.jar and can be found in the /j2ee/jsp/lib/tlds directory. It provides the following custom JSP tags to perform simple XML processing:
xml:transform Takes a stylesheet and applies it to the XML in the tag’s body
xml:styleSheet Declares and locates the stylesheet to be used for xml:transform
xml:parsexml Parses the XML in the body of the tag into a DOM for node access
xml:cacheXMLObject Allows for XML objects such as DOMs to be cached in the Web Object cache
In Oracle XML Database 10g or earlier, these tags do not use the XDK libraries, but instead use the XML ones included in JDK 1.4.
