Best code to sanitize table_name and schema_name

Question

If one writes utility programs that take typically a table_name and a schema_name and one uses execute immediate then it
is not using bind variables and subject to sql injection. So what should I do to cleanse table_name and schema_name?
I see that names of tables are way more flexible than I thought:
http://docs.oracle.com/cd/B28359_01/server.111/b28286/sql_elements008.htm#SQLRF51109
Well we aren't doing quoted identifiers around here for our tables we created so I'm thinking of going for it in terms of
cleansing those parameters in utility programs solely designed to work on our creations. As a very legacy type, I would not create a table name that was not A-Z 0-9 and _  Unfortunately I totally forgot how to write a regex or whatever to get rid of anything not in A-Z 0-9 and _ .
Anyone care to remind me? (I never was good at regex :-(  I know, dumb question...

Answer 1

/* Prints how many distinct values there are in each field in the
given table for only fields that are varchar2,date or number
If the number <= 20 it prints each distinct value and count.
create or replace procedure
value_freq (intable in varchar2, inschema in varchar2 default null) is
  distinct_count integer;
  mystmt varchar2(500) := null;
  mytable varchar2(70) := null;
  good_name varchar2(40) := '^[[:alpha:]][[:alnum:]_]{0,29}$';
  dateformat varchar2(25) := 'mm/dd/yyyy';
  clean_table varchar2(30) := null;
  clean_schema varchar2(30) := null;
  TYPE num_rec IS RECORD
    (value number,
     value_count integer);
  TYPE vchar_rec IS RECORD
    (value varchar2(2000),
     value_count integer);
  TYPE date_rec IS RECORD
    (value date,
     value_count integer);
  TYPE num_table is TABLE OF num_rec INDEX BY binary_integer;
  nums num_table;
  TYPE vchar_table is TABLE OF vchar_rec INDEX BY binary_integer;
  vchars vchar_table;
  TYPE date_table is TABLE OF date_rec INDEX BY binary_integer;
  dates date_table;
BEGIN
  /* This assumes A-Z 0-9 _ table and schema names */
  if regexp_like(intable,good_name) then
      clean_table := upper(intable);
  end if;
  if regexp_like(inschema,good_name) then
      clean_schema := upper(inschema);
  end if;
  if clean_schema is null then
     mytable := upper(clean_table);
  else
     mytable := upper(clean_schema) || '.' || upper(clean_table);
  end if;
  dbms_output.put_line('Distinct value stats for ' || mytable);
  FOR mycol IN (SELECT column_name,data_type FROM all_tab_columns where
      TABLE_NAME = upper(clean_table)
      order by COLUMN_ID ) LOOP
      mystmt := 'SELECT COUNT(*) FROM (select distinct ' || mycol.column_name ||
' from ' || mytable || ')';
      EXECUTE IMMEDIATE mystmt into distinct_count;
      /* thanks to Burleson http://www.dba-oracle.com/plsql/t_plsql_dynamic.htm */
      if (mycol.data_type = 'NUMBER') then
          if (distinct_count > 20) then
              dbms_output.put_line(mycol.column_name || ': ' || distinct_count || ' distinct values too many to print');
          else
              dbms_output.put(mycol.column_name||': ' ||distinct_count || ' distinct values' );
              mystmt := 'select ' || mycol.column_name || ', count(*) from ' ||  mytable
               || ' group by ' || mycol.column_name || ' order by nvl(' || mycol.column_name || ',-99999)';
              --dbms_output.put_line(mystmt);
              EXECUTE IMMEDIATE mystmt BULK COLLECT into nums;
              dbms_output.put_line(chr(9));
              FOR i in nums.FIRST .. nums.LAST LOOP
                   dbms_output.put(nums(i).value || ': '  ||
                        nums(i).value_count || chr(9));
              END LOOP;
              dbms_output.put_line('');
          end if;
      elsif mycol.data_type = 'VARCHAR2' then
          if (distinct_count > 20) then
                dbms_output.put_line(mycol.column_name || ': ' || distinct_count || ' distinct values too many to print');
          else
               dbms_output.put(mycol.column_name||': ' ||distinct_count || ' distinct values' );
               mystmt := 'select ' || mycol.column_name || ', count(*) from ' ||  mytable
               || ' group by ' || mycol.column_name || ' order by nvl(' || mycol.column_name || ','' '')';
              --dbms_output.put_line(mystmt);
               EXECUTE IMMEDIATE mystmt BULK COLLECT into vchars;
               dbms_output.put_line(chr(9));
               FOR i in vchars.FIRST .. vchars.LAST LOOP
                   dbms_output.put(vchars(i).value || ': '  ||
                        vchars(i).value_count || chr(9));
               END LOOP;
               dbms_output.put_line('');
          end if;
      elsif mycol.data_type = 'DATE' then
          if (distinct_count > 20) then
                dbms_output.put_line(mycol.column_name || ': ' || distinct_count || ' distinct values too many to print');
          else
               dbms_output.put(mycol.column_name||': ' ||distinct_count || ' distinct values' );
               mystmt := 'select ' || mycol.column_name || ', count(*) from ' ||  mytable
               || ' group by ' || mycol.column_name || ' order by ' || mycol.column_name;
              --dbms_output.put_line(mystmt);
               EXECUTE IMMEDIATE mystmt BULK COLLECT into dates;
               dbms_output.put_line(chr(9));
               FOR i in dates.FIRST .. dates.LAST LOOP
                   dbms_output.put(to_char(dates(i).value,dateformat) || ': '  ||
                        dates(i).value_count || chr(9));
               END LOOP;
               dbms_output.put_line('');
          end if;
       end if; /* is date */
  END LOOP;
END;
show errors;