Question

I am calling a plsql procedure from window.opener.location.href, I want to pass an array as a parameter to this procedure.

window.opener.location.href="dt_bulk_test_pkg.pc_bulk_test?ps="+frmresult.ps.value+
                            "&p_step="+frmresult.p_step.value+
                            "&p_year="+frmresult.p_year.value+
                            "&p_quarter="+frmresult.p_quarter.value+
                            "&p_diagnostic_type="+frmresult.p_diagnostic_type.value+
                            "&p_overwrite="+frmresult.p_overwrite.value+
                            "&p_company_id="+v_comp_id;

v_comp_id is an array.

Answer 1

PL/SQL is a database technology, Javascript is an in-browser technology (unless you’re doing server side JS with node or Rhino but you are not). The browser can only communicate with web servers. So from the point of javascript, you’re not calling a stored procedure, you’re calling a web-server that you must have running somewhere that calls that stored procedure.

How exactly arrays are represented is up to the server-side language/web-framework, but a fairly standard approach is that taken by jQuery’s $.param method. For example, opening up the console on this site I can do this:

> $.param({example: [1,2,3]})
"example%5B%5D=1&example%5B%5D=2&example%5B%5D=3"

Words of warning.

• Exposing database stored procedures directly via HTTP is not only bad design, but likely a crazy-bad security risk.
• Embedding parameters in a url means you are using an HTTP GET request. GET requests are meant for resources that do not affect the state of the server so be careful that your stored procedure only gets data, not changes it. The danger is that someone could put that url in an email or even an img src tag on a webpage and people would hit that url simply by clicking a link or visiting a web page.
• All parameters should pass through url encoding. Like I mentioned, jQuery.param will do this.
• You are likely exposing yourself to XSS attacks as well.