OraForm: Generically FORM'ing a multi-table query for the Oracle RDBMS


Rocqueforte O'Leary & Anthony Pollard {r.oleary | a.pollard}@st.nepean.uws.edu.au Department of Computing Faculty of Science and Technology University of Western Sydney - Nepean P.O. Box 10 Kingswood New South Wales 2747 Australia Phone +61 47 360 156 Fax: +61 47 360 770
Keywords: World Wide Web, WWW, Oracle, Database, RDBMS, User-Interface, OraForm

Introduction

The University of Western Sydney - Nepean [HREF 5] recently coded a Job Tracking System using Oracle as the database, with the interfacing between Oracle and the web client being done via C programs. At the completion of the project, it became apparent that there was a significant amount of redundancy in these programs, as each of them performed the same database tasks (insert, update, delete and select) on different tables . What was needed was some sort of generic way of manipulating these database tables. There have already been several methods proposed for generic WWW front-ends to Oracle, the more notable ones being GSQL & oraywww. However these were not suitable for our installation, since oraywww needed the scripting language oraperl, and GSQL did not provide the right level of sophistication. It was theorised that a WWW- Oracle interface could be constructed with just two generic programs. The first program, sql-build, would take the query string generated by the web browser, turn it into an SQL statement and then pass this statement on to the second program, sql-result. sql-result would be a modified version of Oracle Corp.'s sample9.pc program, which is a C program that mimics Oracleís standard query interpreter. sql-result would take the generated SQL statement, executes it on the Oracle database, and returns the result to the WWW client. With the success of sql-build and sql-result, a generic database browsing system called OraForm was developed.

How OraForm Works

OraForm consists of 6 programs (oraform.html, oraform1.pc, oraform2.pc, cleaner.sh, sql-build.c and sql-result.pc). Each of these programs are called sequentially, unless one program terminates due to an error (in which case it reports the appropriate Oracle error message to the web client). oraform1.pc, oraform2.pc and sql-result.pc are written in C with embedded SQL, with the executable programs being compiled using Oracle's Pro*C precompiler and a standard C compiler. sql-builder.c is written in standard C, and oraform.html and cleaner.sh are a HTML file and a C shell script respectively.

oraform.html


{figure 1}

oraform.html forms the entry point to the OraForm system. It prompts the user to enter their Oracle username and password, and then calls the first program, oraform1.

oraform1.pc


{figure 2}

oraform1 retrieves all the tables and views that the user has access to in the Oracle database , and presents these as a multicolumn select form to the web client. Once the user has selected one or more tables, oraform2 is called.

oraform2


{figure 3}

oraform2 selects all the unique columns from the tables selected in oraform1 and presents them to the web client as a fill-in form. Uniqueness of a column is determined by its name, its datatype and precision. For example, consider the two tables below:


	    _________________________________________

	    | EMP               | DEPT              |

	    |-------------------|-------------------|

	    | empno     N(4)    | deptno  N(2)      |

	    | ename     C(10)   | dname   C(14)     |

	    | job       C(9)    | loc     C(13)     |

	    | mgr       N(4)    |                   |

	    | hiredate  date    |                   |

	    | sal       N(7,2)  |                   |

	    | comm      N(7,2)  |                   |

	    | deptno    N(2)    |                   |

	    |-------------------|-------------------|

			    {table 1}

By comparing the columns in each table against each other, we can see that deptno is not unique since it occurs in both tables with the same datatype and precision. Therefore, oraform2 would present to the user only emp.empno, emp.ename, emp.job, emp.mgr, emp.hiredate, emp.sal, emp.comm, emp.deptno, dept.dname and dept.loc. When filling in the form, the user may select multiple data values to retrieve, and may also use Oracle wildcards and equivalence operators. For example, figure 3 shows a filled-in form for the tables from table 1, where the user wishes to see all employee numbers (empno), employee names (ename) and the department names (dname) for all employeeís who work in department 20, have an employee number greater than 6000 and less than 8000, and who are either clerks or analysts.

cleaner.sh

Once the filled-in form is submitted, the shell script cleaner.sh is called. cleaner.sh translates escaped characters such as % and < to ASCII, and then passes the edited query string to sql-build.c, the SQL statement generator.

sql-build.c

The purpose of sql-build.c is to break the query string generated by the web client into a meaningful SQL statement. At present, sql-build is coded only to handle select type statements, but future developments will incorporate the ability to handle insert, delete and update operations as well.

A SQL select statement is made up of three blocks, which I have called the "select", "where" and "join" blocks. The "select" block selects the required display records from the relevant tables, the "where" block applies the search conditions to the statement, and the "join" block attempts to avoid Cartesian joins between tables by matching the primary and foreign keys between tables. The "select", "where" and "join" blocks for the query specified in figure 3 are shown in table 2 below:


	_______________________________________________________

	| SQL Statement                            | Block    |

	|------------------------------------------|----------|

	| SELECT dept.dname, emp.empno, emp.ename  | Select   |

	| from dept, emp                           |          |

	|------------------------------------------|----------|

	| WHERE (dept.deptno = '20') AND           |          |     

	|       (emp.empno > = '6000' OR           |          |

	|        emp.empno < = '8000') AND         | Where    |

	|       (emp.job = 'CLERK' OR              |          |

	|        emp.job = 'ANALYST')              |          |

	|------------------------------------------|----------|

	| AND (dept.deptno = emp.deptno)           | Join     |

	|------------------------------------------|----------|

			    {table 2}

Once sql-build.c has generated the select statement, it calls sql- result.pc, passing to it the userís Oracle username, password and the generated select statement.

sql-result.pc


{figure 4}

sql-result.pc is Oracle's sample9.pc program, with the SQL statement module modified to accept the username, password and SQL statement from sql-build.pc rather than getting this information from the keyboard. Providing that the search conditions were properly entered at oraform2.pc, and the search conditions find matching records in the data base, a screen like figure 4 will be produced. Should the search conditions not find any matching data, the same screen will be displayed, with no records retrieved and the message "0 records processed".

Further Work

OraForm currently works as specified, however there are significant improvements to be made. These are:

  • OraForm can currently only build select statements. sql-result has the facility for handling insert, update, delete as well as select type statements, but sql- build needs to be modified to generate these type of statements. Such work is not of any great complexity and is currently being worked on.

  • The database query browser relies upon the user knowing what type of data resides in the data base. This manifests itself in two ways. Firstly, the column names displayed to the user are merely the table column names, and can be (at best) rather bland and (at worst) cryptic. This can resolved either by using the data dictionary table user_col_comments to record ìfullî column names (acceptable, providing user_col_comments are not used for actual comments!), or by setting up a table in the user's Oracle account called oraform_col_names, which records the tablename, the column name and the "full" column name for each table the user owns. A program to automate and maintain this would be highly useful. Secondly, the user has to know what sort of data each column refers to and what data is in that record. For example, when presented with the Job field in figure 3, the user has to know that valid options are either "CLERK", "ANALYST", "MANAGER", "SALESMAN" or "PRESIDENT". It is proposed to solve this dilemma by giving the user the option of selecting either the existing form (called a "fastform") or using a more detailed form (called a "detailed form"), which would retrieve all the fields from the database and display them as a multiple choice list next to the field. A prototype detailed form is shown below in figure 5.


    {figure 5}

  • At present, only the join between tables is user defined (the OR part of the generated sql statement). Whilst this is adequate for single data values, it reduces the flexibility of the system when the user is performing a task on multiple data values. For example, say we wish to find name of all employees who have a manager number greater than 7600 excluding all those employees with a manager number of 7782. The form line for this would look like figure 6. The current version of OraForm would equate this to "where emp.mgr > = '7600' OR emp.mgr != '7782'", which would return 13 rows. What is required is a line that includes the join condition at the end, as shown in figure 7, or by allowing the user to explicitly state the join condition on the line itself, as shown in figure 8. By allowing user control over the join between data values, OraForm would equate this to "where emp.mgr > '7600' AND emp.mgr != '7782'", which would return 10 rows. This requires a small amount of reworking of both oraform2 and sql-build, and is currently being worked on.


    {figure 6}


    {figure 7}


    {figure 8}

  • The security of OraForm needs to be tightened up. Currently, the Oracle username and password can be viewed via looking at the ìshow locationî option (see figure 9). We have attempt to get around this by using the ìpostî method on forms, but this causes the programs to crash. As the ìpostî method has been used successfully before, further investigation of this error is necessary.


    {figure 9}

    Conclusion

    At the completion of the Job Tracking System project, it became apparent that a more generic way of manipulating Oracle databases via the WWW was required. From this requirement sprang the OraForm project. At the heart of the OraForm system are two programs, sql-build.c and sql-result.pc. sql-build is a C program that processes a WWW query string into a SQL statement, and then calls sql-result. sql-result is a C program with embedded SQL for processing the SQL statement and reporting its results to the WWW client. Following the successful implementation of the two programs, a simple data browsing utility called OraForm was created using a HTML file, a UNIX shell script and two furthur embedded SQL C programs.

    The paper has presented a number of further developments for OraForm, all of which should be implemented by June 1995, when OraForm will be released to the public domain.

    Acknowledgments

    We would like to thank the following people and organizations for their help and advice during the duration of this project : Andrew ìAlfî Leahy, David Minard, Paul English and Oracle Corp. (Australia).

    Hypertext References

    HREF 1
    http://www.ncsa.uiuc.edu/SDG/People/jason/pub/gsql/ <- Home of GSQL
    HREF 2
    http://www.nofc.forrestrt.ca/oraywww/ <- Home of oraywww
    HREF 3
    http://www.st.nepean.uws.edu.au/users/rocky/oraform/ <- Home of OraForm
    HREF 4
    http://www.st.nepean.uws.edu.au/index.html <- Dept. Of Computing Web Server @ UWS Nepean
    HREF 5
    http://www.nepean.uws.edu.au/index.html <- UWS Nepean Web Server

    Copyright

    © Southern Cross University, 1995. Permission is hereby granted to use this document for personal use and in courses of instruction at educational institutions provided that the article is used in full and this copyright statement is reproduced. Permission is also given to mirror this document on WorldWideWeb servers. Any other usage is expressly prohibited without the express permission of Southern Cross University.
    Return to the AusWeb95 Table of Contents

    AusWeb95 The First Australian WorldWideWeb Conference