Skip to content

Only Modify Tables Defined in Your Own Package/Component ​

WarningSecurity & Robustness#EC NO_MOD_STD_TABLERemote Enabled

Overview ​

Modify Only Own Database Tables.

ATC Finding Message: Modify only customer-owned database tables (see OWN_TABLES)

Rationale ​

Directly executing INSERT, UPDATE, MODIFY, or DELETE statements on SAP standard tables (like VBAK, BKPF, EKKO, BUT000) bypasses core SAP document locking, document numbering, consistency validations, and business events. Such direct updates corrupt standard SAP database integrity and void SAP enterprise support agreements.

Clean Core Standard: Always use released SAP Business APIs (BAPIs), standard Business Objects, or RAP transactional interfaces to create or update SAP standard data.

Non-Compliant ​

abap
" Highly Dangerous: Direct modification of standard SAP Financials header table
UPDATE bkpf SET bstat = 'V' WHERE belnr = @lv_doc_num.

Compliant ​

abap
" Clean Core: Modification via official released BAPI / RAP interface
CALL FUNCTION 'BAPI_ACC_DOCUMENT_POST'
  EXPORTING
    documentheader = ls_header
  TABLES
    accountgl      = lt_gl
    return         = lt_return.

Configuration & Thresholds ​

This check can be fine-tuned directly in the ATC Check Variant Editor (CHKV) in Eclipse ADT:

Parameter NameData TypeDefault ValueDescription & Guidance
OWN_TABLESString^[yz/]Regex pattern matching custom namespace tables permitted for direct mutation (default: ^[yz/])
REPORT_DYNAMICBooleantrueReport dynamic database statements targeting unverified table variables

Suppression ​

To suppress findings for this rule, append the pseudo-comment to the statement:

abap
" Standard pseudo-comment:
... "#EC NO_MOD_STD_TABLE

" SAP CI_ prefix format:
... "#EC CI_NO_MOD_STD_TABLE

Technical Details ​

Released under the MIT License.