>becoming interesting..! >can someone provide a test case where by, it can be tested how attacker can >attack any sql/plsqlcode..pl..! The attack vector should become apparent once you read the documentation for CREATE INDEX... http://docs.oracle.com/cd/B28359_01/server.111/b28286/statements_5011.htm Cheers, David -- //www.freelists.org/webpage/oracle-l