USING DBMS_SQL WITH A PARAMETERIZED DML STATEMENT

Question

create or replace procedure insert_row ( table_name varchar2, id varchar2,name varchar2, region number) is
csr_id integer;
stmt varchar2(200);
rows_added number;
begin
stmt := ' INSERT INTO ' || table_name || ' VALUES ( :cid , :cname, :rid ) ' ;
csr_id := dbms_sql.open_cursor ;
dbms_sql.parse( csr_id , stmt , dbms_sql.native) ;
dbms_sql.bind_variable( csr_id , ' :cid ' , id );
dbms_sql.bind_variable ( csr_id , ' :cname ' , name) ;
dbms_sql.bind_variable( csr_id , ' :rid ' , region );
rows_added := dbms_sql.execute ( csr_id);
dbms_sql.close_cursor( csr_id);
dbms_output.put_line( rows_added);
end;
execute insert_row( ' countries ' , ' ZA ', ' SOUTH AFRICA ', 4);
Procedure created.
BEGIN insert_row( ' countries ' , ' ZA ', ' SOUTH AFRICA ', 4); END;
ERROR at line 1:
ORA-01006: bind variable does not exist
ORA-06512: at "SYS.DBMS_SYS_SQL", line 923
ORA-06512: at "SYS.DBMS_SQL", line 51
ORA-06512: at "HR.INSERT_ROW", line 9
ORA-06512: at line 1
THE PROCEDURE IS GETTING CREATED BUT WHEN I EXECUTE THE PROCEDURE THEN THIS ERROR COMES IN ..

Answer 1

891794 wrote:
Thank you all , see I am new to this database field , I am not a pro.Not a problem. However, one of the very first things you should learn is that dynamic SQL is seldom needed and invariably just plain wrong.
If a table name is dynamic, or a column name is dynamic - then chances are excellent that your data model is already fubar'ed (or malema'ed to put it in a za.org perspective).
And even when you are in the very exceptional situation where dynamic SQL is needed, SQL injection is a MAJOR security concern.. and almost always ignored by implementing shoddy code to create and execute the dynamic SQL.