Question

The stored procedures being written here currently concats the parameters to the queries:

   SELECT *       FROM Names      WHERE Name = ' || prmName || '   ORDER BY ' || prmSortField 

Is it possible to parameterize this query inside the stored procedure? Possibly like:

query = 'select * From Names Where Name = @name Order By ' || prmSortField call(query, prmName) 

Note:
In case you wonder why we do so, there are two common parameters for our sp’s: sortFieldIndex and sortDirection. Since we cannot directly parameterize these, the query is dynamically generated. But other parameters make the queries open for injection. So I am looking a way to parameterize some of the parameters.

Answer 1

Absolutely. Use cursors.

DECLARE   CURSOR c1 (job VARCHAR2, max_wage NUMBER) IS     SELECT * FROM employees WHERE job_id = job AND salary > max_wage; BEGIN   FOR person IN c1('CLERK', 3000)   LOOP      -- process data record     DBMS_OUTPUT.PUT_LINE('Name = ' || person.last_name || ', salary = ' ||                          person.salary || ', Job Id = ' || person.job_id );   END LOOP; END;