We have been working with Apex since v1.5 and I can tell you, I have yet to come across a web based application requirement that we weren’t able to meet using Apex including large-scale enterprise class applications.

We have built a number of applications tightly integrated with Oracle EBS using both the EBS security and Oracle Single Sign-On. We even have implemented applications providing single sign-on like functionality when using just standard EBS security. Other applications have implemented custom security or LDAP depending upon requirements.

The point to understand here is that at the very least, whatever can be done in the database can be done using Apex and the Oracle database is very very powerful. The fact that Apex runs PL/SQL makes it only that much easier to use; at least as far as I have experienced. In other words, Apex has all the power of the database and the web combined. What cannot be achieved within the db can usually be done with straight HTML, JavaScript or if nothing else, an external component – any component (including flash, java or web services).

The belief that Apex applications published to the internet are not secure is also a pretty big mis-conception. I’ve had a number of customers who’ve balked at the idea of publishing apex applications and I’ve spent countless hours trying to convince them of the security. It is just a matter of architecting (is that even a word?) the environment correctly. There’s a number of ways security can be achieved depending upon the budget and the criticality of the app. Encrypt database connections, put in a reverse proxy, implement the apache webserver in a DMZ, etc.

The only issues that I have seen till now have been the inability publish web services and the lack of a version control mechanism to support large development teams. The former has been mitigated somewhat by Oracle 11g. The latter still remains a problem; but hey, nothing is perfect, right?

Manu