Converting sql to procedure

Question

Hi experts,
I was using the below query in my asp.net page and it is working fine.while i was browsing the internet i stumlbed on the sql injection article and i got so panic and try to convert my existing sql to procedure to avoid sql injection and so far i do not have a luck. I am sure someone out there have an idea how i can convert this sql to procedure.one of the thing that makes so difficult on me is that this sql statemnet is connected to some of the controls i have on my asp.net page. for example when rdDes.Checked the value paramter is passed to this part of the code. I am greatly appreciate for your help and time.
Create or replace procedure ItemSearch(strItem IN varchar2)
SELECT    Item_Number,Short_Description,LONG_DESCRIPTION,UNIT_NAME,PLAN_UNIT_DESCRIPTION, SPEC_YEAR
FROM    ITEMSEARCH
WHERE ITEM <> '2999509/00001'  AND   IOBSELET='N'    AND
If rdDes.Checked Then
              upper(LONG_DESCRIPTION) Like " & strWhereClause
Else If rdUnit.Checked Then
              upper(PLAN_UNIT_DESCRIPTION) like " & strWhereClause
Else If rdNumber.Checked Then
             "'" & Trim(txtItem.Text) & "%" & "'"
                strWhereClause = Replace(strWhereClause, "'%", "''")
                strSQLforGrid = strSQLforGrid & "upper(Item_Number )  like " & strWhereClause
End If
If (ck2005.Checked And ck2000.Checked) Then
            (SPEC_YEAR =  '05' or SPEC_YEAR= '00')
Else If ck2000.Checked Then
             SPEC_YEAR = '00'
Else If ck2001.Checked Then
                SPEC_YEAR = '01'
Else If ck2005.Checked Then
            SPEC_YEAR = '05'"
Else  SPEC_YEAR = '05'
End if
order by Item_Number   asc,LONG_DESCRIPTION   asc
    

Answer 1

Please see the below sample packaged proc. It's not tested.
You will have to change this eventually to Dynamic SQL.
CREATE TABLE ITEMSEARCH
Item_Number NUMBER(10) NOT NULL
,Short_Description VARCHAR2(30)
,LONG_DESCRIPTION VARCHAR2(100)
,UNIT_NAME VARCHAR2(100)
,PLAN_UNIT_DESCRIPTION VARCHAR2(100)
,SPEC_YEAR VARCHAR2(4)
CREATE OR REPLACE PACKAGE ITEM
AS
TYPE RECORDSET IS REF CURSOR;
PROCEDURE SearchItem
in_Spec_Year IN VARCHAR2
,out_RecordSet OUT ITEM.RECORDSET
END ITEM;
CREATE OR REPLACE PACKAGE BODY ITEM
AS
PROCEDURE SearchItem
in_Spec_Year IN VARCHAR2
,out_RecordSet OUT ITEM.RECORDSET
IS
BEGIN
OPEN out_RecordSet
FOR
SELECT Item_Number
,Short_Description
,LONG_DESCRIPTION
,UNIT_NAME
,PLAN_UNIT_DESCRIPTION
,SPEC_YEAR
FROM ITEMSEARCH
WHERE SPEC_YEAR = in_Spec_Year;
EXCEPTION
WHEN OTHERS THEN
RAISE;
END;
END ITEM;
Good Luck