Comments on: How to Dynamically Call PL/SQL Procedure in Oracle

By: Alex Gorbachev

Alex Gorbachev — Tue, 30 Jun 2009 23:45:04 +0000

@Oliver: re invoker vs definer rights – that’s what I was hinting at when used procedure to clean up. ;-)

By: Olivier Mengué

Olivier Mengué — Tue, 30 Jun 2009 15:52:54 +0000

@plsql: you can bind variables in the EXECUTE IMMEDIATE call. See the reference documentation about EXECUTE IMMEDIATE.

By: Olivier Mengué

Olivier Mengué — Tue, 30 Jun 2009 15:49:07 +0000

There is an other issue: user rights.

PL/SQL procedures run with the rights of the user which own them instead of the rights of the user who call them.
This means that the call_dynamically() presented here may also be a way for a user to escape a sandbox to get higher privileges.

By: Alex Gorbachev

Alex Gorbachev — Mon, 15 Jun 2009 12:14:46 +0000

@plsql: Can you clarify potential issues? I don’t see any additional complications. I showed how to use that procedure. If you want, you can even make the wrapper more fine-tuned with additional parameters to be passed.

By: plsql

plsql — Sat, 13 Jun 2009 17:58:06 +0000

Good discussion. One question is : what if the need to pass parameter to this dynamic procedure. Might be an issue here.

By: Log Buffer #149: a Carnival of the Vanities for DBAs | Pythian Group Blog

Log Buffer #149: a Carnival of the Vanities for DBAs | Pythian Group Blog — Fri, 05 Jun 2009 16:50:48 +0000

[...] Here on the Pythian blog, Alex Gorbachev showed how to dynamically call a PL/SQL procedure. [...]

By: Alex Gorbachev

Alex Gorbachev — Fri, 05 Jun 2009 01:05:10 +0000

Thanks for the feedback guys. I didn’t touch on twists with definer and invoker privileges but that’s another topic.

joel, LOL — that’s funny indeed. I won’t correct it and leave it as is — it’s too funny. :)

By: joel garry

joel garry — Thu, 04 Jun 2009 18:58:55 +0000

it can be used to run anonymous PL/SQL blog

As far as typos go, that was pretty entertaining. It could…

By: LewisC

LewisC — Thu, 04 Jun 2009 11:21:07 +0000

I think I have to go with Alex on this one. There is probably a better approach than dynamic calls and definitely a better approach than reflection. ugh. That just sounds like a nightmare in the long run.

LewisC

By: Tim Hall

Tim Hall — Thu, 04 Jun 2009 10:23:15 +0000

Hi.

Without wanting to sound obvious, the big issue with dynamically calling a procedure is what happens if the procedure is not there? :)

People really need to think carefully about whether they actually need dynamic SQL in their production code. It’s a very good way of introducing runtime errors into your code. There is a warm and fuzzy feeling about no compile-time errors/warnings, but this means nothing if you are using dynamic SQL.

Obvious warning over… :)

Regarding calling a private procedure, that is what invoker rights is for. :)

Cheers

Tim…