Oracle Apex 19.x external URL based on items value

Question

I'm using Application Express 19.2.0.00.18 with Oracle Database 12c Enterprise Edition Release 12.2.0.1.0. In our applications (from 4.x) we use Jaspersoft Reports to create PDFs (invoices, labels, shipping documents, etc.) and we use a db function that take in parameters like report name and page items values and returns an html tag for link. E.G.:

myFunction (myReportName, P01_ITEM_A ,P01_ITEM_B)
return
<a href="http://myjasperserver/rest/myReportName.pdf?x=itemAvalue&y=itemBvalue"><img scr="/imagespath/pdf.png"></a>

In this way it is possible to render where needed a clickable image to generate a report based on actual values of items. This solution is heavy adopted in our Apex applications but we are facing some difficulties trying to do the same in 19.x. We need some help or suggestions in order to reproduce the same feature or to do the same in a different way.

As suggested by Littlefoot I can specify that "difficulties" are :

• In Apex 4.x the query : select someFieldList ,myFunction (myReportName, P01_ITEM_A ,P01_ITEM_B) PDF from dual results in a report with the column PDF that is a clickable image (or text, the png is not mandatory). In Apex 19.x the same query results in a report with the column PDF rendered as Plain Text.
• In Apex 4.x if I use the same query as Source attribute of a Display Only item it is rendered as a clickable link (text or image). In Apex 19.x the Display Only item is always not clickable.

Answer 1

The solution to both issues is the same. APEX 19.2 is a lot more advanced than APEX 4.x, and by default is more secure. For both Plain Text report columns and Display Only page items the default security setting is "Escape special characters":

This deliberately escapes any HTML tags in the contents to avoid potential XSS (cross-site scripting) security risks.

Simply unselect this setting and your links will appear as links again.