Question

So here is my code:

CREATE OR REPLACE PROCEDURE UPDATE_USER
(
  updateColumn IN USERS.column_name%type,
  changeStr IN VARCHAR2,
  unID IN VARCHAR2
)
IS
BEGIN
  EXECUTE IMMEDIATE
    'UPDATE
      users
    SET :1 = :2
    WHERE
      uniqueID = :3'
  USING updateColumn, changeStr, unID; 
END;
/

I’ve searched for other answers on this and as far as I can tell this should work. However I get the error:
‘Error(3,25): PLS-00302: component ‘COLUMN_NAME’ must be declared’

Thanks.

Answer 1

The error message specifies line 3, character 25, which points to column_name in the declaration of the updateColumn parameter. It appears that you are trying to pass the column name to update as a parameter, but that means that at compile time the column isn’t known, so its type can’t be known. This also doesn’t really make sense – if it’s a number column then you’d be trying to pass the column name into a numeric parameter, which wouldn’t work anyway. If you don’t want to declare it as a simple varchar2, you could instead use user_tab_columns.column_name%type.

But you can’t dynamically set the column name in the update statement using a bind variable. It would compile, but would get an ORA-01747 on execution from the apparent name starting with a colon. You’d need to concatenate it, something like:

CREATE OR REPLACE PROCEDURE UPDATE_USER
(
  updateColumn IN user_tab_columns.column_name%type,
  changeStr IN VARCHAR2,
  unID IN VARCHAR2
)
IS
BEGIN
  EXECUTE IMMEDIATE
    'UPDATE
      users
    SET ' || updateColumn || ' = :1
    WHERE
      uniqueID = :2'
  USING changeStr, unID; 
END;
/

But you’d need to sanitise the column name to avoid SQL injection. APC’s answer to the question you linked to mentions using the DBMS_ASSERT package, for example.