15.3 Binding Variables

You have seen several examples of the use of bind variables or arguments with NDS. Let's now go over the various rules and special situations you may encounter when binding.

15.3.1 Binding Versus Concatenation

In most situations, you can take two different paths to insert program values into your SQLstring: binding and concatenation. The following table contrasts these approaches for a dynamic UPDATE statement.

Binding	Concatenation
EXECUTE IMMEDIATE 'UPDATE ' || tab 'SET sal = :new_sal' USING v_sal;	EXECUTE IMMEDIATE 'UPDATE ' || tab 'SET sal = ' || v_sal;

Binding involves the use of placeholders and the USING clause; concatenation shortcuts that process by adding the values directly to the SQL string. When should you use each approach? I recommend that you bind arguments whenever possible (see the next section for limitations on binding) rather than rely on concatenation. There are two reasons for taking this approach:

Binding is faster

When you bind in a value, the SQL string does not contain the value, just the placeholder name. Therefore, you can bind different values to the same SQL statement without changing that statement. Because it is the same SQL statement, your application can more likely take advantage of the preparsed cursors that are cached in the System Global Area (SGA) of the database.

Binding is easier to write and maintain

When you bind, you don't have to worry about datatype conversion; it is all handled for you by the NDS engine. In fact, binding minimizes datatype conversion because it works with the native datatypes. If you use concatenation, you will often need to write very complex, error-prone string expressions involving multiple single quotes, TO_DATE and TO_CHAR function calls, and so on. For example, consider the following comparison of concatenation and binding for a more complex statement:

/* Binding */

EXECUTE IMMEDIATE

'UPDATE employee SET salary = :val

WHERE hire_date BETWEEN :lodate AND :hidate'

USING v_start, v_end;

/* Concatenation */

EXECUTE IMMEDIATE

'UPDATE employee SET salary = ' || val_in ||

' WHERE hire_date BETWEEN ' ||

' TO_DATE (''' || TO_CHAR (v_start) || ''')' ||

' AND ' ||

' TO_DATE (''' || TO_CHAR (v_end) || ''')';

So bind whenever possible. But when is binding not an option?

15.3.2 Limitations on Binding

You can bind into your SQL statement only those expressions (literals, variables, complex expressions) that replace placeholders for data values inside the dynamic string. You cannot bind in the names of schema elements (tables, columns, etc.) or entire chunks of the SQL statement (such as the WHERE clause). For those parts of your string, you must use concatenation.

For example, suppose you want to create a procedure that willtruncate the specified view or table. Your first attempt might look something like this:

CREATE OR REPLACE PROCEDURE truncobj (

nm IN VARCHAR2,

tp IN VARCHAR2 := 'TABLE',

sch IN VARCHAR2 := NULL)

IS

BEGIN

EXECUTE IMMEDIATE

'TRUNCATE :trunc_type :obj_name'

USING tp, NVL (sch, USER) || '.' || nm;

END;

This code seems perfectly reasonable. But when you try to run the procedure you'll get this error:

ORA-03290: Invalid truncate command - missing CLUSTER or TABLE keyword

And if you rewrite the procedure to simply truncate tables, as follows:

EXECUTE IMMEDIATE 'TRUNCATE TABLE :obj_name' USING nm;

Then the error becomes:

ORA-00903: invalid table name

Why does NDS (and DBMS_SQL) have this restriction? When you pass a string to EXECUTE IMMEDIATE, the runtime engine must first parse the statement. The parse phase guarantees that the SQL statement is properly defined. PL/SQL can tell that the following statement is valid:

'UPDATE emp SET sal = :xyz'

without having to know the value of :xyz. But how can PL/SQL know if the following statement is well formed?

'UPDATE emp SET :col_name = :xyz'

Even if you don't pass in nonsense for col_name, it won't work. For that reason, you must use concatenation:

CREATE OR REPLACE PROCEDURE truncobj (

nm IN VARCHAR2,

tp IN VARCHAR2 := 'TABLE',

sch IN VARCHAR2 := NULL)

IS

BEGIN

EXECUTE IMMEDIATE

'TRUNCATE ' || tp || ' ' || NVL (sch, USER) || '.' || nm;

END;