I used this small slide deck on July 3 2018 for my Ask TOM Office Hours session on dynamic SQL. You can watch the recording here: https://devgym.oracle.com/pls/apex/dg/office_hours/4486

1. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
1
Steven Feuerstein
Oracle Developer Advocate for PL/SQL
Oracle Corporation
Email: steven.feuerstein@oracle.com
Twitter: @sfonplsql
Blog: stevenfeuersteinonplsql.blogspot.com
YouTube: Practically Perfect PL/SQL

2. Copyright © 2018 Oracle and/or its affiliates. All rights reserved. |
2
What's wrong with this code?
CREATE OR REPLACE FUNCTION name_from_id (id_in IN INTEGER)
RETURN VARCHAR2
AUTHID DEFINER
IS
l_the_name names.the_name%TYPE;
BEGIN
EXECUTE IMMEDIATE
'select the_name from names where id = ' || id_in
INTO l_the_name;
RETURN l_the_name;
END;
• Return the name for an ID.

3. Copyright © 2018 Oracle and/or its affiliates. All rights reserved. |
3
Only Use Dynamic SQL When Necessary
• The SQL statement cannot be parsed at compile-time.
• The database objects are created "just in time".
• There's a compelling argument to be made for code
maintenance.
– Avoiding lots of repetition, for example
– Most likely for non-user-facing functionality

4. Copyright © 2018 Oracle and/or its affiliates. All rights reserved. |
4
Bind, Don't Concatenate
• You should always bind values using the INTO clause.
• Reduces need for hard-parsing, improves performance,
reduces opportunities for SQL injection.
• You cannot bind names of tables and columns, or
"chunks" of SQL text.
– PL/SQL must be able to parse the statement.

5. Copyright © 2018 Oracle and/or its affiliates. All rights reserved. |
5
Binding and Dynamic SQL Now "Needed"
CREATE OR REPLACE FUNCTION name_from_id (
table_in IN VARCHAR2, id_in IN INTEGER)
RETURN VARCHAR2
AUTHID DEFINER
IS
l_the_name names.the_name%TYPE;
BEGIN
EXECUTE IMMEDIATE
'select the_name from ' || table_in || ' where id = :the_id'
INTO l_the_name
USING id_in;
RETURN l_the_name;
END;
• (ignoring the question: "Is this a good idea?")

6. Copyright © 2018 Oracle and/or its affiliates. All rights reserved. |
6
What's wrong with this code?
CREATE OR REPLACE FUNCTION name_from_id (
table_in IN VARCHAR2, id_in IN INTEGER)
RETURN VARCHAR2
AUTHID DEFINER
IS
l_the_name names.the_name%TYPE;
BEGIN
EXECUTE IMMEDIATE
'select the_name from ' || table_in || ' where id = :the_id'
INTO l_the_name
USING id_in;
RETURN l_the_name;
END;
• In case you are wondering, it's the same code as the previous slide.

7. Copyright © 2018 Oracle and/or its affiliates. All rights reserved. |
7
Protect Your Concatenations
• User input should never be fed directly into a dynamic
SQL statement: that's the way in for SQL injection.
• If you are concatenating in names of tables, schemas,
etc., use the DBMS_ASSERT package to validate those
names.
• You could also explicitly check for "dangerous" characters
like ";"

8. Copyright © 2018 Oracle and/or its affiliates. All rights reserved. |
8
Dynamic SQL with a little protection
CREATE OR REPLACE FUNCTION name_from_id (
table_in IN VARCHAR2, id_in IN INTEGER, where_in IN VARCHAR2)
RETURN VARCHAR2
IS
l_the_name names.the_name%TYPE;
BEGIN
EXECUTE IMMEDIATE
'select the_name from ' ||
DBMS_ASSERT.qualified_sql_name (table_in)
|| ' where id = :the_id '
|| TRANSLATE (where_in, 'A;|', 'A')
INTO l_the_name
USING id_in;
RETURN l_the_name;
END;
• Better safe than sorry.

9. Copyright © 2018 Oracle and/or its affiliates. All rights reserved. |
9
Other Dynamic SQL Good-to-Knows
• Don't use DBMS_SQL unless absolutely necessary.
– Likely a method 4 requirement (at compile time, don't know number of
columns in SELECT list or number of bind variables)
• EXECUTE IMMEDIATE a variable, so if there is an error you can log
the statement you tried to execute.
• When you execute a dynamic DDL statement, the database
automatically commits before and after the statement.

10. Copyright © 2018 Oracle and/or its affiliates. All rights reserved. |
10
Why Dynamic SQL in APEX?
• A question regarding dynamic SQL. We know that, as you
also said, we should use dynamic SQL only when it truly
NEEDED. Why then all the SQL and PL/SQL from the APEX
engine run as dynamic SQL? Every time when a developer
defines a query for their report STATICALLY or runs a
query inside the SQL Workshop, it's been executed
DYNAMICALLY (this fact is even mentioned somewhere in
the documentation). I'm aware of the fact that APEX uses
`DBMS_SYS_SQL` to run SQL and PL/SQL, but I believe
this approach was chosen deliberately. Why so?

11. Copyright © 2018 Oracle and/or its affiliates. All rights reserved. |
11
Answer from Joel Kallman
• https://joelkallman.blogspot.com/2010/08/application-express-and-
parsing-of-sql.html
• The Oracle database also ships with a supplied but undocumented PL/SQL
package named SYS.DBMS_SYS_SQL. This package enables the execution of
dynamic SQL but it also enables the parsing of a statement as a specific
database user and with the privileges of this specific database user. This
PL/SQL package is highly privileged, obviously. The EXECUTE privilege on
this package is not granted to database user, by default.

12. Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
asktom.oracle.com
Questions?
Share your thoughts!
1