Sql injection question

Question

This is about a stackoverflow question.
http://stackoverflow.com/questions/1267025/how-to-calculate-value-of-string-in-oracle
I (aka tuinstoel) have provided an answer how to protect against sql injection but I'm not completely sure I'm offering good advice.
My answer on stackoverflow:
http://stackoverflow.com/questions/1267025/how-to-calculate-value-of-string-in-oracle/1268243#1268243
Can anyone say whether my method is sound or provide one or more counterexamples?

Answer 1

how about parsing the dynamic SQL and getting an execution plan for it first - and then check that execution plan against a kind of predefined templateIsn't a nice xml output not much easier to parse?
SQL>  declare
     cl clob;
begin
     dbms_lob.createtemporary (
          cl,
          true
     sys.utl_xml.parsequery (
          user,
          'select e.deptno from emp e where deptno = 10',
          cl
     dbms_output.put_line (cl);
     dbms_lob.freetemporary (cl);
end;
<QUERY>
  <SELECT>
    <SELECT_LIST>
      <SELECT_LIST_ITEM>
        <COLUMN_REF>
          <SCHEMA>MICHAEL</SCHEMA>
          <TABLE>EMP</TABLE>
          <TABLE_ALIAS>E</TABLE_ALIAS>
          <COLUMN_ALIAS>DEPTNO</COLUMN_ALIAS>
          <COLUMN>DEPTNO</COLUMN>
        </COLUMN_REF>
        <COLUMN_ALIAS>DEPTNO</COLUMN_ALIAS>
      </SELECT_LIST_ITEM>
    </SELECT_LIST>
  </SELECT>
  <FROM>
    <FROM_ITEM>
      <SCHEMA>MICHAEL</SCHEMA>
      <TABLE>EMP</TABLE>
      <TABLE_ALIAS>E</TABLE_ALIAS>
    </FROM_ITEM>
  </FROM>
  <WHERE>
    <EQ>
      <COLUMN_REF>
        <SCHEMA>MICHAEL</SCHEMA>
        <TABLE>EMP</TABLE>
        <COLUMN>DEPTNO</COLUMN>
      </COLUMN_REF>
      <VALUE>10</VALUE>
    </EQ>
  </WHERE>
</QUERY>
PL/SQL procedure successfully completed.;)