Best way to write a function that returns query texts

Question

Hi, I need to write a function that will take a parameter containing table name and based upon it returns the text of a query. Here is what I am thinking of doing it but would like to get feedback whether there is a better way to do it.
For example:
FUNCTION getSQL(p_1 VARCHAR2, p_2 VARCHAR2) RETURN VARCHAR2
IS
   sql varchar2(2000);
BEGIN
--Here i want IF THEN ELSE part and thes based upon it return a desired sql. There will be more than a dozen sqls that the function will return.
IF p_1='Employee' Then
sql:='Select * from employee Where employee_id=p_2;'
Else If p_1='Departement' Then
sql:='Select col1, col2, col3,';
sql:=sql || ' col4, col5, col6';
sql:=sql || ' Where dept_id=p_2';
Else If.....
Else If.....
Else If.....
Else If.....
End IF;
return sql;
END;Edited by: dreporter on Sep 20, 2010 8:43 AM

Answer 1

I'm never sure I understand the desire to put lots of cursors into a single stored procedure, given that they are inherently different things.
However, assuming you have made the above decision, you should almost certainly look at using the overload of dbms_xmlgen.newcontext that accepts a cursor parameter rather than a string. This would allow you to return cursors from your function rather than strings, giving you the option to use bind variables (and prevent associated SQL injection) and perhaps not even do dynamic SQL at all, something like this perhaps...
FUNCTION get_cursor (
   p_cursor_type VARCHAR2,
   p_cursor_parameter VARCHAR2)
   RETURN sys_refcursor
IS
   v_sys_cursor sys_refcursor;
BEGIN
   CASE p_cursor_type
      WHEN 'Employee' THEN
         OPEN v_cursor FOR
            SELECT empno, ename
              FROM emp
             WHERE empno = TO_NUMBER (p_cursor_parameter);
      WHEN 'Department' THEN
         OPEN v_cursor FOR
            SELECT deptno, dname
              FROM dept
             WHERE deptno = TO_NUMBER (p_cursor_parameter);
   END CASE;
   RETURN v_sys_cursor;
END get_cursor;
/