Can some selection conditions as PL/SQL procedure input parameters

Question

Dear All,
I need to write a PL/SQL procedure so as to compute the different query only by changing the input parameters. But those input parameters need to be like a PL/SQL table selection conditions. Like:
one of the query I need two conditions:
customers.zip = 60606
customers.zip = employees.zipMy procedure can compute the query like:
select customers.cno, cname, employees.eno, ename
from customers, orders, employees
where customers.cno = orders.cno and
      employees.eno = orders.eno and
      C; 
where C is the conjunction of the conditions in the input parameter.
Please help and thanks in advance!

Answer 1

Well, it's easy enough to do what you want....
SQL> conn scott/tiger
Connected.
SQL> CREATE OR REPLACE FUNCTION flexi_q (pn_deptno IN NUMBER, pv_string IN VARCHAR2 := NULL)
  2  RETURN sys_refcursor AS
  3    return_value sys_refcursor;
  4  BEGIN
  5    IF pv_string IS NULL THEN
  6          OPEN return_value FOR SELECT * FROM emp WHERE deptno = pn_deptno;
  7    ELSE
  8          OPEN return_value FOR 'SELECT * FROM emp WHERE deptno = :1 AND '
  9          ||pv_string USING pn_deptno; 
10    END IF;
11    RETURN return_value;
12  END;
13  /
Function created.
SQL> var rc refcursor
SQL> exec :rc := flexi_q(30)
PL/SQL procedure successfully completed.
SQL> print rc
     EMPNO ENAME      JOB              MGR HIREDATE         SAL       COMM
    DEPTNO
      7499 ALLEN      SALESMAN        7698 20-FEB-81       1600        300
        30
      7698 BLAKE      MANAGER         7839 01-MAY-81       2850
        30
      7900 JAMES      CLERK           7698 03-DEC-81        950
        30
      7654 MARTIN     SALESMAN        7698 28-SEP-81       1250       1400
        30
      7844 TURNER     SALESMAN        7698 08-SEP-81       1500          0
        30
      7521 WARD       SALESMAN        7698 22-FEB-81       1250        500
        30
6 rows selected.
SQL> exec :rc := flexi_q(30, 'SAL > 1400')
PL/SQL procedure successfully completed.
SQL> print rc
     EMPNO ENAME      JOB              MGR HIREDATE         SAL       COMM
    DEPTNO
      7499 ALLEN      SALESMAN        7698 20-FEB-81       1600        300
        30
      7698 BLAKE      MANAGER         7839 01-MAY-81       2850
        30
      7844 TURNER     SALESMAN        7698 08-SEP-81       1500          0
        30
SQL> The real question is: do you really want to do this? Fundamentally you are handing over control of your app to any nimrod who thinks they know how to write SQL. It's just about allowable for them to add simple restrictions but they could add in anything - correlated sub-queries, extravagant sorts, etc. Even if they don't deliberately exploit this hole you still have a fundamentally untunable part of your app.
It would be much better to have some additional parameters that allows the users to choose from several off-the-peg queries. If you have a user demanding the ability to write "any report I need" I recommend talking to them. The chances are they simply have a pet query, probably embodied in an Excel spreadsheet, they run once every month. Give them a view to meet that need and they'll be happy.
Cheers, APC