Quoting identifiers for dynamic SQL in PL/SQL

Question

Is there a PL/SQL function or general technique to quote unqualified identifiers (e.g., mytable) for use in a dynamically constructed SQL query? How about partially or fully qualified identifiers (a.b@c)?

Consider this contrived example:

CREATE PROCEDURE by_the_numbers(COL_NAME VARCHAR, INTVAL INTEGER) IS
  ...
BEGIN
  -- COL_NAME is interpolated into SQL string
  -- INTVAL gets bound to :1
  stmt := 'SELECT * FROM tbl WHERE ' || COL_NAME || ' = :1';
  ...
END

... where we don't want to permit naive SQL injection in COL_NAME (e.g., a value of '1=1 or 1').

Answer 1

There is dbms_assert: http://www.oracle-base.com/articles/10g/dbms_assert_10gR2.php for preventing sql injection.