动态查询构建不产生任何结果并导致进程崩溃

Question

I am trying to run a SQL query within a PL/SQL script that takes dynamic parameters and should return a specific result. For that I tried the EXECUTE IMMEDIATE command. Unfortunately it crashes always my variable is a varchar. If it is a number instead it runs perfetcly.

Here is my tried code:

plsql_request := 'SELECT :x FROM TEST_TABLE WHERE ID = :y';
EXECUTE IMMEDIATE plsql_request INTO plsql_result USING variable_1, '2837123 | hsiae';   

While testing it crashes always in this constelation.
Second approch:

plsql_request := 'SELECT ' || variable_1 || ' FROM TEST_TABLE WHERE ID = ''' || variable_2 || '''';
EXECUTE IMMEDIATE plsql_request ;

I do not get any results at all, hence I think the query-building using dynamic variables in combination with varchars fails.

Any help apreciated,
Filip.

Answer 1

You cannot use a bind variable for an object literal like a column name, table name, etc.. so you must use the second method with || variable_1 || to splice in your dynamic column name. However, you should use real bind variables:y, USING, etc.. for your predicate value in order to not generate an excessive number of child cursors.

So, :

plsql_request := 'SELECT '||variable_1||' FROM TEST_TABLE WHERE ID = :y';
EXECUTE IMMEDIATE plsql_request INTO plsql_result USING '2837123 | hsiae';