2. HTML Expression
<span class="id-col" pk="#EMPLOYEE_ID_NUM#">#EMPLOYEE_ID#</span> 3.PLugin Sql: SELECT '<script>alert("xss")</script><h4>Basic Information of : ' || EMPLOYEE_NAME ||'</h4>' ||'<table> <tr> <td> Image </td> <td> : </td> <td> '||decode(nvl(dbms_lob.getlength(E.PICTURE),0),1,null,'<img src="'||apex_util.get_blob_file_src('P10_PICTURE',E.UNIQUE_ID)||'" height="75" width="75"/>')||' </td> </tr> <tr> <td> Name </td> <td> : </td> <td> '||E.EMPLOYEE_NAME||' </td> </tr> <tr> <td> Join Date </td> <td> : </td> <td> '||to_char(E.JOINING_Date,'fm dd-Mon-RRRR')||' </td> </tr> <tr> <td> Phone </td> <td> : </td> <td> '||E.MOBILE_NO||' </td> </tr> <tr> <td> Email </td> <td> : </td> <td> '||E.PERSONAL_EMAIL||' </td> </tr> <tr> <td> Department </td> <td> : </td> <td> '||(SELECT CODE_DESC FROM CODE_MASTER WHERE HARD_CODE='DPT' AND SOFT_CODE=E.DEPARTMENT_ID)||' </td> </tr> <tr> <td> Police Station </td> <td> : </td> <td> '||(SELECT LOCATION_NAME FROM AREA_INFORMATION WHERE LOCATION_CODE=E.PERMANENT_THANA)||' </td> </tr> <tr> <td> District </td> <td> : </td> <td> '||(SELECT LOCATION_NAME FROM AREA_INFORMATION WHERE LOCATION_CODE=E.PERMANENT_DISTRICT)||' </td> </tr> ' AS TOOLTIP, 'floralwhite' AS BACKGROUNDCOLOR FROM EMPLOYEE_INFORMATION E WHERE UNIQUE_ID=:P7_NEW