> It also makes it so easy to create opportunities for SQL injection if you don't have careful coders.
This is not the case. If you bind values with :ITEM_NAME and use compiled statements (never dynamic string concatenated ones with "execute immediate') there is no chance of SQL injection.
You can set items from the URL, which you usually can't do with most web frameworks. Of course you can enable Session State Protection, but you have to be vigilant.
This is not the case. If you bind values with :ITEM_NAME and use compiled statements (never dynamic string concatenated ones with "execute immediate') there is no chance of SQL injection.