出于安全性或避免影響性能的考慮，在產(chǎn)品數(shù)據(jù)庫中有時候會禁止或者在一定時間段內限制DDL語句的發(fā)生。Oracle也提高了很多方法來實現(xiàn)這個功能，這個簡單介紹一下。

這篇介紹利用觸發(fā)器來限制DDL語句。

我們用3個用戶舉例，test 用戶不受觸發(fā)器限制，test2用戶和test3 用戶受觸發(fā)器限制，不允許DDL操作

SQL> create user

test identified by test;

User created.

SQL> create user

test2 identified by test2;

User created.

SQL> create user

test3 identified by test3;

User created.

SQL> grant

connect,resource to test,test2,test3;

Grant succeeded.

分別在3個用戶下創(chuàng)建一個表

SYS@test>conn

test/test

Connected.

TEST@test>create

table t (id int);

Table created.

TEST@test>conn

test2/test2

Connected.

TEST2@test>create

table t (id int);

Table created.

TEST2@test>conn

test3/test3

Connected.

TEST3@test>create

table t (id int);

Table created.

試下看看能不能做ddl操作

TEST3@test>conn

test/test

Connected.

TEST@test>alter

table t add (name int);

Table altered.

TEST@test>conn

test2/test2

Connected.

TEST2@test>alter

table t add (name int);

Table altered.

TEST2@test>conn

test3/test3

Connected.

TEST3@test>alter

table t add (name int);

Table altered.

由此看出3個用戶目前都能做DDL操作

下面創(chuàng)建觸發(fā)器。使當test做DDL操作時候數(shù)據(jù)不報錯。test2，test3做DDL操作數(shù)據(jù)庫報錯，不允許做ddl操作

創(chuàng)建觸發(fā)器

TEST3@test>conn /

as sysdba

Connected.

SYS@test>CREATE

or? replace TRIGGER ddl_trigger

2

before ddl on database

3

declare

4? n

number;

5

l_trace? number;

6

BEGIN

7? if

ora_dict_obj_owner() = 'TEST2'? then

8

raise_application_error(-20001,'You can not execute ddl? on

'|| ora_dict_obj_name );

9

elsif ora_dict_obj_owner() = 'TEST3' then

10

raise_application_error(-20001,'You can not execute ddl? on

'|| ora_dict_obj_name );

11? end

if ;

12? END;

13? /

Trigger created.

下面分別在3個用戶做測試。

SYS@test>conn

test/test

Connected.

TEST@test>alter

table t add (com int);

Table altered.

在test用戶下沒有問題

在test2.test3，用戶下數(shù)據(jù)庫都報錯，禁止DDL操作

TEST@test>conn

test2/test2

Connected.

TEST2@test>alter

table t add (com int);

alter table t add

(com int)

*

ERROR at line 1:

ORA-00604: error

occurred at recursive SQL level 1

ORA-20001: You can

not execute ddl? on??? T

ORA-06512: at line 6

TEST2@test>conn

test3/test3

Connected.

TEST3@test>alter

table t add (com int);

alter table t add

(com int)

*

ERROR at line 1:

ORA-00604: error

occurred at recursive SQL level 1

ORA-20001: You can

not execute ddl? on??? T

ORA-06512: at line 8

以下是觸發(fā)器全部內容，供大家參考

CREATE or? replace TRIGGER ddl_trigger

before ddl on

database

declare

n number;

l_trace? number;

BEGIN

if

ora_dict_obj_owner() = 'TEST2'? then

raise_application_error(-20001,'You

can not execute ddl? on??? '|| ora_dict_obj_name );

elsif

ora_dict_obj_owner() = 'TEST3'

then

raise_application_error(-20001,'You

can not execute ddl? on??? '|| ora_dict_obj_name );

end if ;

END;

/

總結

以上是生活随笔為你收集整理的oracle回收ddl权限,oracle禁止指定用户DDL操作触发器的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內容還不錯，歡迎將生活随笔推薦給好友。