Can you pass SQL to a function?

Question

I have the following function:
CREATE OR REPLACE PROCEDURE run_query(p_sql IN VARCHAR2) IS
  v_v_val     VARCHAR2(4000);
  v_n_val     NUMBER;
  v_d_val     DATE;
  v_ret       NUMBER;
  c           NUMBER;
  d           NUMBER;
  col_cnt     INTEGER;
  f           BOOLEAN;
  rec_tab     DBMS_SQL.DESC_TAB;
  col_num     NUMBER;
  v_rowcount  NUMBER := 0;
  v_csv          VARCHAR2(32000);
BEGIN
  -- create a cursor
  c := DBMS_SQL.OPEN_CURSOR;
  -- parse the SQL statement into the cursor
  DBMS_SQL.PARSE(c, p_sql, DBMS_SQL.NATIVE);
  -- execute the cursor
  d := DBMS_SQL.EXECUTE(c);
  -- Describe the columns returned by the SQL statement
  DBMS_SQL.DESCRIBE_COLUMNS(c, col_cnt, rec_tab);
  -- Bind local return variables to the various columns based on their types
  FOR j in 1..col_cnt
  LOOP
    CASE rec_tab(j).col_type
      WHEN 1 THEN DBMS_SQL.DEFINE_COLUMN(c,j,v_v_val,2000); -- Varchar2
      WHEN 2 THEN DBMS_SQL.DEFINE_COLUMN(c,j,v_n_val);      -- Number
      WHEN 12 THEN DBMS_SQL.DEFINE_COLUMN(c,j,v_d_val);     -- Date
    ELSE
      DBMS_SQL.DEFINE_COLUMN(c,j,v_v_val,2000);  -- Any other type return as varchar2
    END CASE;
  END LOOP;
  -- This part outputs the DATA
  LOOP
    -- Fetch a row of data through the cursor
    v_ret := DBMS_SQL.FETCH_ROWS(c);
    -- Exit when no more rows
    EXIT WHEN v_ret = 0;
    v_rowcount := v_rowcount + 1;
    -- Fetch the value of each column from the row
    FOR j in 1..col_cnt  
    LOOP
      -- Fetch each column into the correct data type based on the description of the column
      CASE rec_tab(j).col_type
        WHEN 1  THEN DBMS_SQL.COLUMN_VALUE(c,j,v_v_val);
                     v_csv:= v_csv||','||v_v_val;
        WHEN 2  THEN DBMS_SQL.COLUMN_VALUE(c,j,v_n_val);
                     v_csv:= v_csv||','||v_n_val;
        WHEN 12 THEN DBMS_SQL.COLUMN_VALUE(c,j,v_d_val);
                     v_csv:= v_csv||','||to_char(v_d_val,'DD/MM/YYYY HH24:MI:SS');
      ELSE
        DBMS_SQL.COLUMN_VALUE(c,j,v_v_val);
        DBMS_OUTPUT.PUT_LINE(v_v_val);
      END CASE;     
    END LOOP;
    dbms_output.put_line(substr(v_csv,2));
    v_csv:='';
  END LOOP;
  DBMS_SQL.CLOSE_CURSOR(c);
END;
It allows you to feed in an arbitrary query and have returned a comma-separated set of data. For example:
SQL> exec run_query('select * from scott.emp where deptno = 10');
7782,CLARK,MANAGER,7839,09/06/1981 00:00:00,2450,,10
7839,KING,PRESIDENT,,17/11/1981 00:00:00,5000,,10
7934,MILLER,CLERK,7782,23/01/1982 00:00:00,1300,,10
PL/SQL procedure successfully completed.
SQL> exec run_query('select * from (select * from scott.emp where deptno = 10 order by sal desc) where rownum < 5');
7839,KING,PRESIDENT,,17/11/1981 00:00:00,5000,,10
7782,CLARK,MANAGER,7839,09/06/1981 00:00:00,2450,,10
7934,MILLER,CLERK,7782,23/01/1982 00:00:00,1300,,10
(I'm not saying this is good practice: quite the opposite. But it's a requirement that's been set and I need to know how to meet it, not argue with it).
My question is: the code works when the query submitted to it doesn't include single quotes. As soon as it does, it dies:
SQL> exec run_query('select 'Example', sal from scott.emp where deptno = 10');
BEGIN run_query('select 'Example', sal from scott.emp where deptno = 10'); END;
ERROR at line 1:
ORA-06550: line 1, column 26:
PLS-00103: Encountered the symbol "EXAMPLE" when expecting one of the
following:
) , * & = - + < / > at in is mod remainder not rem =>
<an exponent (**)> <> or != or ~= >= <= <> and or like like2
like4 likec as between from using || multiset member
submultiset
The symbol ", was inserted before "EXAMPLE" to continue.
I could obviously escape the 'internal' single quotes, but the aim is for end-users to feed in their queries, not have to re-write them with tricky escape sequences!
So the question is: is there a way I can let users feed their SQL into the procedure without having to worry about single quotes that might be in the middle of it?
Again, I realise the risk of SQL injection... but I'd like assistance on the practicalities of quotation characters, not the management of a risk which I'm well aware of (and dealing with outside the procedural code I've shown here).
In other words, even if you think this is the worst idea in the world, I'd still like to know how I could feed 'select 'Example', sal from scott.emp where deptno = 10'to the procedure and have it run correctly.

Answer 1

Well, I'm going to say it's completely the wrong tool for the job simply because I don't know how to write it! Saying 'do it in Java' is like telling a Windows sysadmin 'do it in emacs'... might well be the right, most powerful, comprehensive and safest way of doing something, but if the skillset is foreign, it doesn't get you far!
Well I can understand why that might be your initial reaction.
But the fact is that ALL of your comments apply even more to use of the DBMS_SQL package. That package is not well known by most developers, is not used by most developers and, when it is used, is often misused.
Even if you want to pursue other options why don't you at least take a look at the two concepts involved in a Java Stored Procedure solution.
Here is a simple example from The Java Tutorials that shows how easy it is to execute a query that is contained in a string and iterate the result set.
http://docs.oracle.com/javase/tutorial/jdbc/basics/retrieving.html
Retrieving and Modifying Values from Result Sets
The following method, CoffeesTable.viewTable outputs the contents of the COFFEES tables, and demonstrates the use of ResultSet objects and cursors:
And here is an equally simple example from the Oracle Java Developer's Guide that shows how to write and execute a simple Java Stored Function.
http://docs.oracle.com/cd/B28359_01/java.111/b31225/chfive.htm
Java Stored Procedures Steps
You can run Java stored procedures in the same way as PL/SQL stored procedures. Normally, a call to a Java stored procedure is a result of database manipulation, because it is usually the result of a trigger or SQL DML call. To call a Java stored procedure, you must publish it through a call specification.
Before you can call Java stored procedures, you must load them into Oracle Database instance and publish them to SQL. Loading and publishing are separate tasks. Many Java classes, which are referenced only by other Java classes, are never published.
To load Java stored procedures automatically, you can use the loadjava tool. It loads Java source, class, and resource files into a system-generated database table, and then uses the SQL CREATE JAVA {SOURCE | CLASS | RESOURCE} statement to load the Java files into Oracle Database instance. You can upload Java files from file systems, popular Java IDEs, intranets, or the Internet.
The following steps are involved in creating, loading, and calling Java stored procedures:
  Step 1: Create or Reuse the Java Classes
  Step 2: Load and Resolve the Java Classes
  Step 3: Publish the Java Classes
  Step 4: Call the Stored Procedures
  Step 5: Debug the Stored Procedures, if Necessary
You also didn't mention what you plan to do with the results.
Sql Developer (free from Oracle - http://www.oracle.com/technetwork/developer-tools/sql-developer/downloads/index.html) can very easily query arbitrary data and produce a delimited result.
Here is what a simple query would look like:
SELECT /*csv*/ * from SCOTT.EMP;
THAT'S IT!
The data comes back in a grid and the user can save it to a file, open it in Excel or whatever. It doesn't get any simpler than that.
Take a look at this article by Jeff Smith (a moderator of the sql developer forum) that shows what you can easily do
http://www.thatjeffsmith.com/archive/2013/04/sql-developer-preferences-for-delimited-text-exports/
Even if you decide not to use these other options, or decide that are not a good fit, you should always strive to learn about other techniques and where to find info about them. Who knows, one of these days you may need one of them.
Just as important is that other forum readers understand that their are other, IMHO simpler, solutions out there for your problem.