Stored Procedure Help: Source does not have a runnable target

Question

I'm an MS-SQL guy, so I'm fairly familiar with T-SQL syntax, but am having one heck of a time trying to take code I've written for SQL and transform it to work with Oracle.
Anyways, I'm using Oracle's SQL Developer, and I've got a stored procedure that calls the Alter Table statement and adds a column to it. I'm just trying to get this one to work before I move on to the other one's I have. I keep getting the message Source does not have a runnable target when I try running this command.
create or replace PROCEDURE rta_conv_addcolumn(rtatablename1 in varchar(20),
rtatablename2 in varchar(20),
rtacolumnname in varchar(256),
rtacolumninfo in varchar(256))
AS
DECLARE rtasql VARCHAR(4000);
BEGIN
IF EXISTS (SELECT * FROM user_tables WHERE table_name = rtatablename1)
AND NOT EXISTS (SELECT * FROM user_tab_columns WHERE column_name = rtacolumnname
AND table_name = rtatablename1)
AND NOT EXISTS (SELECT * FROM user_tab_columns WHERE column_name = rtacolumnname
AND table_name = rtatablename2)
Then rtasql:= 'ALTER TABLE ['+rtatablename2+'] ADD ' + rtacolumnname + ' ' + rtacolumninfo;
Execute (rtasql);
END rta_conv_addcolumn;
If I try compiling it I get the following messages, which don't make sense, since the syntax I'm using for declaring the input variables looks to be right.
Error(1,54): PLS-00103: Encountered the symbol "(" when expecting one of the following: := . ) , @ % default character The symbol ":=" was substituted for "(" to continue.
Error(2,29): PLS-00103: Encountered the symbol "(" when expecting one of the following: := . ) , @ % default character The symbol ":=" was substituted for "(" to continue.
Error(3,29): PLS-00103: Encountered the symbol "(" when expecting one of the following: := . ) , @ % default character The symbol ":=" was substituted for "(" to continue.
Error(4,29): PLS-00103: Encountered the symbol "(" when expecting one of the following: := . ) , @ % default character The symbol ":=" was substituted for "(" to continue.
Error(6,1): PLS-00103: Encountered the symbol "DECLARE" when expecting one of the following: begin function package pragma procedure subtype type use <an identifier> <a double-quoted delimited-identifier> form current cursor external language The symbol "begin" was substituted for "DECLARE" to continue.
Error(15,5): PLS-00103: Encountered the symbol "RTA_CONV_ADDCOLUMN" when expecting one of the following: if

Answer 1

What table you want to add the column to? rtatablename1 or rtatablename2? I assumed 1 for now.
I tried to preserve your code structure so you can familiarize with it.
This piece should work, but you need to make sure you validate the parameters you concatenate to your strings when you use dynamic SQL.
That's when SQL injection takes place: when you trust the parameters you are receiving and don't validate them.
Also remember that DDL statements execute an implicit commit. Any previous DML operations you have pending will be commited by
this EXECUTE IMMEDIATE call if it succeeds.
I'd recommend some reading at the Oracle docs regarding those topics and the invoker's vs definer's rights for procedures.
It basically means that as a default behaviour, the user running the procedure "borrows" the rights and privileges of the procedure owner,
and that guy is usually super-privileged.
http://download.oracle.com/docs/cd/E11882_01/appdev.112/e10472/subprograms.htm#LNPLS00809
CREATE OR REPLACE PROCEDURE rta_conv_addcolumn
  rtatablename1 IN VARCHAR,
  rtatablename2 IN VARCHAR,
  rtacolumnname IN VARCHAR,
  rtacolumninfo IN VARCHAR
) AS
  rtasql VARCHAR(4000);
  v_count NUMBER;
BEGIN
  SELECT COUNT(*)
    INTO v_count
    FROM user_tables
   WHERE table_name = upper(rtatablename1)
         AND NOT EXISTS (SELECT *
                           FROM user_tab_columns
                          WHERE column_name = upper(rtacolumnname)
                                AND table_name = upper(rtatablename1))
         AND NOT EXISTS (SELECT *
                           FROM user_tab_columns
                          WHERE column_name = upper(rtacolumnname)
                                AND table_name = upper(rtatablename2));
  IF v_count > 0
  THEN
    -- is it to the rtablename1 or 2 you want to add this column to?
    rtasql := 'ALTER TABLE ' || rtatablename1 ||' ADD ' || rtacolumnname || ' ' || rtacolumninfo;
    EXECUTE IMMEDIATE rtasql;
  END IF;
END rta_conv_addcolumn;Edited by: fsitja on Dec 11, 2009 11:21 PM