it is both possible and recommended... however, it might depend on where you plan to use the application. If it's going to be used in the internal network, then it might not me necessary. If it's going to be published over internet, then I'd suggest you do it. Also, for devel environments with no sensitive data it's not really that important. hth Alan Bort Oracle Certified Professional -- //www.freelists.org/webpage/oracle-l