WHERE clause sources

Question

Hi,
it is said that there are four WHERE clause sources:
1. WHERE clause block property (on datablock or programatically defined)
2. ONETIME_WHERE clause block property (on datablock)
3. Example Record
4. Query/Where dialog box
I dont have any idea where I can find/ where the process takes place for items 3&4? Please enlighten me. Thanks

Answer 1

You can update some data, and you can see lots of data you shouldn't. Eg in a form based on emp and with a restriction in the block's where clause property, you can bring up the Query/Where window and type garbage. Then the "Help > Display Error" window shows something like this
SELECT ROWID,EMPNO,ENAME,JOB,MGR,HIREDATE,SAL,COMM,DEPTNO
FROM scott.emp WHERE deptno = user_dept_no() and (garbage!)The proper Where Clause will only let you see data from your own department, but if you put
1=2) union select ROWID,EMPNO,ENAME,JOB,MGR,HIREDATE,SAL,COMM,DEPTNO
FROM scott.emp WHERE (1=1in the Query/Where window, you can see and update the data from all departments.
And if you try
1=2) union select null, null, table_name, null,null, null,null, null,null
from all_tables WHERE (1=1then you're on your way towards getting access to lots of data which you shouldn't. A form with a large text field would be better for this sort of hacking.
Trying to update through a function gets this:
ORA-14551: cannot perform a DML operation inside a queryWith well defined synonyms, privileges and FGAC/VPD it should be safe to keep this enabled. Putting something after the colons means you don't need to know the column names.
It's handy functionality but I've never been keen on the user-unfriendliness of this window. I'd rather see a dialog showing all the Prompt names and next to each would be a list containing 'Between, <=, != etc', with a free text field after that (or a date picker for date fields, something else for checkboxes, multi-select lists for the list fields, etc). Another for the wish list!