e-Commerce Applications Using Oracle8i and Java from Scratch

Securing Applications

Views can be used to control access to the information stored in the database.

Suppose that you have an employees table containing information about all employees. The principle of least privilege would require that any employee should be able to see only information that pertains to her. The following view can be used for this purpose:

Create view employees_v as
   Select * from employees
   Where emp_name = USER

Similarly, the following view allows a user to access only those records that are modified by him:

Create view orders_v as
   Select * from orders
   Where last_modified_by = USER

The preceding example assumes that in the orders table we are using a last_modified column to indicate the user who last modified that particular ...