Filter records by varchar2 parameter s using like '%abc%' etc

Question

hi
I am calling Storeprocedure with varchar2 parameters.
when parameter is null it returns all the records which i want to be returned but when parameter has value it returns nothing.
SP is
PROCEDURE "PROC_GET_FILTERED_RECORDS" (
"P_CURSOR" OUT SYS_REFCURSOR,
"P_COLUMN_NAME" IN VARCHAR2 ,
"P_VALUE" IN VARCHAR2
)as
BEGIN
OPEN P_CURSOR FOR
SELECT * from myTable
WHERE P_COLUMN_NAME LIKE P_VALUE OR P_VALUE IS NULL;
END;
Call from c# class:
using (OracleConnection cn = new OracleConnection(this.ConnectionString))
OracleCommand cmd = new OracleCommand(sql, cn);
cmd.CommandType = CommandType.StoredProcedure;
cmd.BindByName = true;
cmd.Parameters.Add("P_CURSOR", OracleDbType.RefCursor, ParameterDirection.Output);
cmd.Parameters.Add("P_COLUMN_NAME", OracleDbType.Varchar2, exp, ParameterDirection.Input);
cmd.Parameters.Add("P_VALUE", OracleDbType.Varchar2, val, ParameterDirection.Input);
cn.Open();
cmd.ExecuteReader();
i have tried following
'=' sign instead of like (in store procedure)
orignal column name instead of p_column (in store procedure)
"'%'"+ val + "'%'" ( % sign and single qoutes)
"%"+ val + "%" (just % signs )
just val string (without % and qoutes)
i have checked the values during debugging store procedure ,values match the record/ records in table
but same query works in asp.net c# class
using (OracleConnection cn = new OracleConnection(this.ConnectionString))
string sql = "select * from myTable;
sql += " where ('%" + val + "%' = NULL or "+exp+ " LIKE '%" + val + "%') ";
OracleCommand cmd = new OracleCommand(sql, cn);
this works correctly as i want.
why storeprocedure returns nothing when there is a value in parameters
I am using odp.net , asp.net vs2008

Answer 1

I don't think that dbms_sql will work. How can you return the results of dbms_sql to your .NET client?
You have to use a ref cursor or return a collection (nested table). A ref cursor is faster than a collection because it consumes less memory.
create or replace procedure proc_get_filtered_records
                            ( p_cursor out sys_refcursor
                            , p_column_name in varchar2
                            , p_value in varchar2)
is
begin
  if p_value is null then
    open p_cursor for
      select * from mytable;
  else
    open p_cursor for
     ' select * from mytable where '||dbms_assert.qualified_sql_name(p_column_name)||' like :p_value' using p_value;     
  end if;  
end;
/dbms_assert.qualified_sql_name provides protection against sql injection.