Calling a sql script file from a function.

Question

Hi,
I need to call a sql script file from a user defined function. Currently i am trying to do this in Oracle SQL Developer. i tried calling with
@ {filename}, EXECUTE IMMEDIATE etc, but nothing worked. I get the Compiler error.
Basically my need is to call catldap.sql file so that DBMS_LDAP package gets loaded and then I can call the API functions from this.
Please let me know if this is possible doing in a PL/SQL function.
thanks,
Naresh

Answer 1

user784520 wrote:
I need to call a sql script file from a user defined function. Not possible.. and it seems that you do not fully understand the client-server within the Oracle context.
All SQL and PL/SQL are parsed and executed by an Oracle server process. The SQL and PL/SQL engines each expects a single command block at a time. Neither of these can accept a series of separate commands as a single call and then execute each in turn. The SQL engine expects a single SQL statement at a time. The PL engine expects a single PL/SQL anonymous block at a time.
This server process also cannot break into the local file system to access script files. Nor can it hack across the network to access script files on the client.
In order for the server process to access local files, a directory object needs to be created and the current Oracle schema needs read and/or write access on that directory object. As sound security principles apply.
There's no PL/SQL command to execute a script. You must not mistake SQL*Plus commands (this client has a very limited vocabulary) with PL/SQL commands. SQL*Plus executes its own commands.. and send SQL and PL/SQL commands (a statement block a time) to the Oracle server process to be serviced and executed.
It is also a very bad idea to execute external script contents from inside an Oracle server process - as that script resides externally and thus outside Oracle's security mechanisms. This means that is is pretty easy for someone to access that script, compromise it, and then have you inject and execute the contents of that script into the database.
It is not sound security.
Last issue - it is even worse to have application PL/SQL code dynamically creating (or trying to create) portions of the Oracle data dictionary and PL/SQL call interface.
The database needs to be installed correctly - and this includes loading and executing the required rdbms/admin scripts during database installation. It does not make sense at all for application code to try and execute such scripts. It raises numerous issues, including having to allow that application code full and unrestricted SYS access to the database instance. A very serious security violation.
I do not agree at all with the approach you want to use.