Wednesday, 28 May 2025

How to use CONTINUE inside a PL/SQL loop

CONTINUE inside a PL/SQL loop

Today lets see how to use CONTINUE inside a PL/SQL loop. The CONTINUE statement skips the rest of the current iteration and moves to the next one.

SQL> DECLARE
  2    v_counter NUMBER := 0;
  3  BEGIN
  4    FOR i IN 1..10 LOOP
  5      -- Skip even numbers
  6      IF MOD(i, 2) = 0 THEN
  7        CONTINUE;
  8      END IF;
  9
 10      v_counter := v_counter + 1;
 11      DBMS_OUTPUT.PUT_LINE('Processing odd number: ' || i);
 12    END LOOP;
 13
 14    DBMS_OUTPUT.PUT_LINE('Total odd numbers processed: ' || v_counter);
 15  END;
 16* /

PL/SQL procedure successfully completed.

Explanation: The loop runs from 1 to 10. When the number is even (MOD(i, 2) = 0), CONTINUE skips to the next iteration. Only odd numbers are processed and counted.

INHERIT Privilege for Code Objects in 23ai

'The INHERIT privilege in Oracle controls the ability to run invoker's rights code securely.'

'It helps prevent unauthorized access when executing PL/SQL units owned by another user.'

'You must explicitly grant INHERIT privileges to allow one user to run code with another’s context.'

'This privilege is especially important when dealing with definer's rights procedures.'

'Oracle introduced this feature to enhance security and reduce the risk of privilege escalation.'

New privilege that controls who can inherit invoker privileges, for more secure PL/SQL execution.

SQLcl: Release 24.4 Production on Thu May 29 00:09:26 2025

Copyright (c) 1982, 2025, Oracle.  All rights reserved.

Last Successful login time: Thu May 29 2025 00:09:27 +05:30

Connected to:
Oracle Database 23ai Enterprise Edition Release 23.0.0.0.0 - for Oracle Cloud and Engineered Systems
Version 23.8.0.25.05

SQL> GRANT INHERIT PRIVILEGES ON USER hr TO app_user;

Grant succeeded.

Use Case: Secure execution of procedures that use AUTHID CURRENT_USER.

23ai new feature - IF [NOT] EXISTS for DDL

Smart DDL with Conditional Create and Drop

'Skip the pain of pre-checks when creating or dropping objects.'

"SQL> -- Only create table if it doesn't already exist
SQL> CREATE TABLE IF NOT EXISTS dept (
  2    dept_id NUMBER,
  3    dept_name VARCHAR2(100)
  4* );

Table DEPT created.

SQL>
SQL> -- Safely drop table if it exists
SQL> DROP TABLE IF EXISTS dept;

Table DEPT dropped."

'Use Case: Safer and cleaner DDL in deployment scripts.'

PL/SQL 23ai (Oracle 23c) – New Feature Boolean Data Type in SQL

Oracle 23c - BOOLEAN Column Support

'Finally! You can use BOOLEAN as a column type in tables and queries.'

SQLcl: Release 24.4 Production on Wed May 28 23:48:53 2025

Copyright (c) 1982, 2025, Oracle.  All rights reserved.

Last Successful login time: Wed May 28 2025 23:48:54 +05:30

Connected to:
Oracle Database 23ai Enterprise Edition Release 23.0.0.0.0 - for Oracle Cloud and Engineered Systems
Version 23.8.0.25.05

SQL> -- Create a table with a BOOLEAN column
SQL> CREATE TABLE employee_status (
  2    emp_id NUMBER PRIMARY KEY,
  3    is_active BOOLEAN
  4  );

Table EMPLOYEE_STATUS created.

SQL>
SQL> -- Insert into BOOLEAN column
SQL> INSERT INTO employee_status VALUES (1001, TRUE);

1 row inserted.

SQL> INSERT INTO employee_status VALUES (1002, FALSE);

1 row inserted.

SQL>
SQL> -- Query BOOLEAN column
SQL> SELECT * FROM employee_status WHERE is_active;

   EMP_ID IS_ACTIVE
_________ ____________
     1001 true

Use Case: Cleaner logic for status flags, without relying on 1/0 or Y/N.

Thursday, 15 May 2025

Enhancing Data Security with Oracle 23ai Data Redaction

In today's data-driven landscape, safeguarding sensitive information is paramount. Oracle Database 23ai introduces advanced Data Redaction capabilities, empowering organizations to protect confidential data without altering the underlying database.


🔍 What is Oracle Data Redaction?

Oracle Data Redaction allows for the dynamic masking of sensitive data in query results, ensuring that unauthorized users cannot view confidential information. This feature operates transparently, modifying data output at runtime without changing the stored data.


🛡️ Key Features in Oracle 23ai

  1. Diverse Redaction Methods:

    • Full Redaction: Replaces entire data entries with default values (e.g., zeros for numbers, spaces for text).

    • Partial Redaction: Masks parts of data, such as displaying only the last four digits of a credit card number.

    • Regular Expression Redaction: Utilizes patterns to identify and redact data, ideal for formats like email addresses.

    • Random Redaction: Substitutes data with random values, maintaining data type consistency.

    • Nullify Redaction: Replaces data with null values, effectively hiding it.

    • No Redaction: Allows for testing policies without applying redaction. 

  2. Enhanced SQL Support:

    • Redacted columns can now be used in SQL expressions, including CONCAT, SUM, TRIM, MIN, and MAX, within views and inline views.

    • Support for GROUP BY and DISTINCT clauses on redacted columns, facilitating complex queries without compromising data security.

    • Set operations involving redacted columns are now supported, ensuring consistent redaction across combined query results. 

  3. Performance Optimizations:

    • Policy expressions evaluating to TRUE (e.g., 1=1) are optimized, reducing unnecessary evaluations and enhancing query performance.

  4. Integration with Database Features:

    • Redaction policies can be applied to columns involved in function-based indexes and extended statistics, allowing for comprehensive data protection without hindering database performance. 


🔧 Implementing Data Redaction Policies

Oracle provides the DBMS_REDACT PL/SQL package to manage redaction policies. Here's a basic example:

BEGIN
  DBMS_REDACT.ADD_POLICY(
    object_schema => 'HR',
    object_name   => 'EMPLOYEES',
    policy_name   => 'EMP_SALARY_REDACTION',
    column_name   => 'SALARY',
    function_type => DBMS_REDACT.FULL,
    expression    => 'SYS_CONTEXT(''USERENV'', ''SESSION_USER'') != ''HR_MANAGER'''
  );
END;
/

This policy fully redacts the SALARY column in the EMPLOYEES table for users other than HR_MANAGER. 


📌 Use Cases

  • Read-Only Applications: Redact sensitive data displayed on dashboards or reports without affecting the underlying data.

  • Data Management Tools: Prevent exposure of confidential information during data loading or management operations.

  • Analytics and Reporting: Ensure that analysts and report viewers see only redacted data, maintaining compliance with data privacy regulations. 


⚠️ Considerations

  • Licensing: Data Redaction is part of Oracle's Advanced Security Option, which may require additional licensing.

  • Not a Substitute for Access Control: While Data Redaction obscures data in query results, it does not replace robust access control mechanisms. 


Oracle Database 23ai's enhanced Data Redaction capabilities provide a robust framework for protecting sensitive information, ensuring that organizations can meet compliance requirements and safeguard data privacy without compromising functionality or performance.


Redacting the data in 23ai Oracle Database

 In this post we will learn how to redact Salary column in employees table of 23ai Oracle database.

As Admin user configure the redact policy as -



PL/SQL Code Highlighting

PL/SQL Code


BEGIN
    DBMS_REDACT.ADD_POLICY(
        object_schema => 'ADMIN',
        object_name   => 'EMP',
        policy_name   => 'REDACT_SENSITIVE_DATA',
        expression    => 'SYS_CONTEXT(''USERENV'',''SESSION_USER'') != ''HR'''
    );
END;
/
SET ECHO ON
BEGIN
    DBMS_REDACT.ALTER_POLICY(
        object_schema => 'ADMIN',
        object_name   => 'EMP',
        column_name   => 'SAL',
        policy_name   => 'REDACT_SENSITIVE_DATA',
        function_type => DBMS_REDACT.FULL
    );
END;
/
Employee Table
Original table Employee Records from ADMIN.EMP
EMPNO ENAME JOB MGR HIREDATE SAL COMM DEPTNO
7369 SMITH CLERK 7902 17-12-80 800 20
7499 ALLEN SALESMAN 7698 20-02-81 1600 300 30
7521 WARD SALESMAN 7698 22-02-81 1250 500 30
7566 JONES MANAGER 7839 02-04-81 2975 20
7698 BLAKE MANAGER 7839 01-05-81 2850 30
7782 CLARK MANAGER 7839 09-06-81 2450 10
7788 SCOTT ANALYST 7566 19-04-87 3000 20
7839 KING PRESIDENT 17-11-81 5000 10
7844 TURNER SALESMAN 7698 08-09-81 1500 0 30
7934 MILLER CLERK 7782 23-01-82 1300 10
Employee Table
Employee Records from app user after policy is configured from ADMIN.EMP
EMPNO ENAME JOB MGR HIREDATE SAL COMM DEPTNO
7369 SMITH CLERK 7902 17-12-80 0 20
7499 ALLEN SALESMAN 7698 20-02-81 0 300 30
7521 WARD SALESMAN 7698 22-02-81 0 500 30
7566 JONES MANAGER 7839 02-04-81 0 20
7698 BLAKE MANAGER 7839 01-05-81 0 30
7782 CLARK MANAGER 7839 09-06-81 0 10
7788 SCOTT ANALYST 7566 19-04-87 0 20
7839 KING PRESIDENT 17-11-81 0 10
7844 TURNER SALESMAN 7698 08-09-81 0 0 30
7934 MILLER CLERK 7782 23-01-82 0 10
So now you see the normal app user is seeing redacted output and salary as 0, however the original contents of table has salary, please note the ADMIN user will see the original data because he has EXEMPT REDACTION POLICY privilege. So if this privilege EXEMPT REDACTION POLICY is given to someone he or she will be able to see the original contents.

Error Message = ORA-12514: Cannot connect to database.

 I recently encountered a situation where one of my free Oracle autonomous cloud database was throwing Error Message = ORA-12514: Cannot connect to database, while connecting to the database, the reason was simple - The database was hibernated in cloud because i did not access from a long time.

Here is the full error details -


SQLcl: Release 24.4 Production on Thu May 15 23:44:45 2025


Copyright (c) 1982, 2025, Oracle.  All rights reserved.


Connection failed

  USER          = admin

  URL           = jdbc:oracle:thin:@(description= (retry_count=20)(retry_delay=3)(address=(protocol=tcps)(port=1522)(host=adb.ap-mumbai-1.oraclecloud.com))(connect_data=(service_name=re2d3bgg7ywwtp7_pydb_medium.adb.oraclecloud.com))(security=(ssl_server_dn_match=yes)))

  Error Message = ORA-12514: Cannot connect to database. Service re2d3bgg7ywwtp7_pydb_medium.adb.oraclecloud.com is not registered with the listener at host adb.ap-mumbai-1.oraclecloud.com port 1522. (CONNECTION_ID=qI3rAjuSRe+lAwcEvdtwcg==)

https://docs.oracle.com/error-help/db/ora-12514/


Solution :- Start the database from cloud console and try again after the database is started -



SQLcl: Release 24.4 Production on Thu May 15 23:48:44 2025


Copyright (c) 1982, 2025, Oracle.  All rights reserved.


Last Successful login time: Thu May 15 2025 23:48:45 +05:30


Connected to:

Oracle Database 23ai Enterprise Edition Release 23.0.0.0.0 - for Oracle Cloud and Engineered Systems

Version 23.8.0.25.05


SQL> show user

USER is "ADMIN"


# So there you go , this is how you fix the Error Message = ORA-12514: Cannot connect to database