Create dynamic query for search using Oracle - oracle

Question

I need to search in my Oracle Database using filters based on the dropdown's. So there are total 3 dropdowns and one textbox for searching parameters. Now what I want is.
If User Selects APPLICATION from the first dropdown and Project Name from second dropdown and LIKE condition from third dropdown. A dynamic query should be created and based on that it should filter the record from the database. For that What I tried is below
PROCEDURE FILTER_SEARCH_DATA
(
P_SEARCH_TYPE IN NVARCHAR2,
P_PARAM_TYPE IN NVARCHAR2,
P_OPERATOR IN NVARCHAR2,
P_TEXTVAL IN NVARCHAR2,
P_RETURN OUT SYS_REFCURSOR
)
AS
STR NVARCHAR2(400):='';
STROP NVARCHAR2(400):='';
STREX NVARCHAR2(4000):='';
BEGIN
IF(P_OPERATOR ='LIKE') THEN
BEGIN
STR:=STR || ' WHERE AM.APPLICATIONNAME ' || P_OPERATOR || '''%' || P_TEXTVAL ||'%''';
END;
ELSE
BEGIN
STR:=STR || 'WHERE AM.APPLICATIONNAME ' || P_OPERATOR || P_TEXTVAL ;
END;
END IF;
DBMS_OUTPUT.PUT_LINE('STR'|| STR);
IF P_SEARCH_TYPE = 'APPLICATION' THEN
DBMS_OUTPUT.PUT_LINE('START APPLICATION');
STREX:='OPEN P_RETURN FOR SELECT AM.APPLICATIONNAME, AM.PROJECTNO, AM.VSS_FOLDER_LOC FROM APPLICATION_MASTER AM
INNER JOIN APPLICATION_DETAILS AD
ON AM.APP_MST_ID = AD.APP_MST_ID' || str ||';';
DBMS_OUTPUT.PUT_LINE('STREX '|| STREX);
END IF;
END FILTER_SEARCH_DATA;
But it is not working accordingly for what I want.
Let me know if you have any issues related to this.

Answer 1

Your problem is here:
STREX:='OPEN P_RETURN FOR SELECT AM.APPLICATIONNAME, AM.PROJECTNO, AM.VSS_FOLDER_LOC FROM APPLICATION_MASTER AM
INNER JOIN APPLICATION_DETAILS AD
ON AM.APP_MST_ID = AD.APP_MST_ID' || str ||';';
DBMS_OUTPUT.PUT_LINE('STREX '|| STREX);
This code just outputs a string into the standard output. You need to use this:
PROCEDURE FILTER_SEARCH_DATA
(P_SEARCH_TYPE IN NVARCHAR2,
P_PARAM_TYPE IN NVARCHAR2,
P_OPERATOR IN NVARCHAR2,
P_TEXTVAL IN NVARCHAR2,
P_RETURN OUT SYS_REFCURSOR ) AS
STR NVARCHAR2(400):='';
STROP NVARCHAR2(400):='';
STREX VARCHAR2(4000):='';
val NVARCHAR2(4000);
BEGIN
IF (P_OPERATOR ='LIKE') THEN
val := '%' || P_TEXTVAL ||'%';
ELSE
val := P_TEXTVAL;
END IF;
DBMS_OUTPUT.PUT_LINE('STR'|| STR);
IF P_SEARCH_TYPE = 'APPLICATION' THEN
DBMS_OUTPUT.PUT_LINE('START APPLICATION');
STREX:='SELECT AM.APPLICATIONNAME, AM.PROJECTNO, AM.VSS_FOLDER_LOC
FROM APPLICATION_MASTER AM
INNER JOIN APPLICATION_DETAILS AD
ON AM.APP_MST_ID = AD.APP_MST_ID
WHERE AM.APPLICATIONNAME ' || P_OPERATOR || ' :PARAM';
DBMS_OUTPUT.PUT_LINE('STREX '|| STREX);
open P_RETURN for STREX using val;
END IF;
END FILTER_SEARCH_DATA;
Also, I added using of parameters (:PARAM in the SQL code), it helps with performance and allows to avoid SQL injections.
Another one important thing: in your code you open the cursor only if P_SEARCH_TYPE equals to 'APPLICATION'. You need to do something in other cases, or your procedure will return closed cursor.
UPD
STREX should be VARCHAR2, not NVARCHAR2.