Can I use "order by" with user input in oracle?

Question

I use the same procedure for several tasks. Each function also needs to use ORDER BY every time. I want to use ORDER BY with user inputs.

I tried this but it didn't work.

  PROCEDURE GET_DEPARTMENT_LIST(ORDER_BY_PARAM IN VARCHAR2, DEPT_DATA OUT  T_CURSOR) IS
  V_CURSOR T_CURSOR;
  BEGIN
  OPEN V_CURSOR FOR
  SELECT GET_LIST(ORDER_BY_PARAM) FROM DUAL;
  DEPT_DATA  := V_CURSOR;
  END GET_DEPARTMENT_LIST;
  
  FUNCTION GET_LIST (PAR_ORDER_BY IN VARCHAR2)
     RETURN SYS_REFCURSOR
    IS
      L_CR SYS_REFCURSOR;
    BEGIN
      OPEN L_CR FOR
          SELECT DEPARTMENT_ID, DEPARTMENT_CODE, DEPARTMENT_NAME 
          FROM DEPARTMENT ORDER BY PAR_ORDER_BY ASC;
      RETURN L_CR;
  END;

Procedure Executed Query :

VARIABLE RC REFCURSOR;
EXECUTE DEPARTMENT_PKG.GET_DEPARTMENT_LIST('DEPARTMENT_NAME', :RC);
PRINT RC;

Result :

Answer 1

Sure you can. For example:

SQL> create or replace function get_list (par_order_by in varchar2)
  2    return sys_refcursor
  3  is
  4    l_rc sys_refcursor;
  5  begin
  6    open l_rc for
  7      'select empno, ename, job, sal from emp where deptno = 10 order by ' || par_order_by;
  8    return l_rc;
  9  end;
 10  /

Function created.

Testing:

SQL> select get_list('ename') result from dual;

RESULT
--------------------
CURSOR STATEMENT : 1

CURSOR STATEMENT : 1

     EMPNO ENAME      JOB              SAL
---------- ---------- --------- ----------
      7782 CLARK      MANAGER         2450
      7839 KING       PRESIDENT       5000
      7934 MILLER     CLERK           1300


SQL> select get_list('job, sal') result from dual;

RESULT
--------------------
CURSOR STATEMENT : 1

CURSOR STATEMENT : 1

     EMPNO ENAME      JOB              SAL
---------- ---------- --------- ----------
      7934 MILLER     CLERK           1300
      7782 CLARK      MANAGER         2450
      7839 KING       PRESIDENT       5000


SQL>

---

As you noticed, I created a function - for simplicity - instead of a procedure with an OUT parameter. If you have to use a procedure, no problem; it is the ORDER BY you had problem with, not the way you'll return the result to the caller.

---

[EDIT: procedure that calls a function]

SQL> CREATE OR REPLACE PROCEDURE get_dept_list (
  2     order_by_param  IN     VARCHAR2,
  3     dept_data          OUT SYS_REFCURSOR)
  4  IS
  5  BEGIN
  6     OPEN dept_data FOR SELECT get_list (order_by_param) FROM DUAL;
  7  END get_dept_list;
  8  /

Procedure created.

SQL> CREATE OR REPLACE FUNCTION get_list (par_order_by IN VARCHAR2)
  2     RETURN SYS_REFCURSOR
  3  IS
  4     l_rc  SYS_REFCURSOR;
  5  BEGIN
  6     OPEN l_rc FOR
  7           'select empno, ename, job, sal from emp where deptno = 10 order by '
  8        || par_order_by;
  9
 10
 11     RETURN l_rc;
 12  END;
 13  /

Function created.

Sorted by ENAME:

SQL> var rc refcursor
SQL> exec get_dept_list('ename', :rc)

PL/SQL procedure successfully completed.

SQL> print rc

GET_LIST(:B1)
--------------------
CURSOR STATEMENT : 1

CURSOR STATEMENT : 1

     EMPNO ENAME      JOB              SAL
---------- ---------- --------- ----------
      7782 CLARK      MANAGER         2450
      7839 KING       PRESIDENT       5000
      7934 MILLER     CLERK           1300

Sorted by JOB:

SQL> exec get_dept_list('job', :rc)

PL/SQL procedure successfully completed.

SQL> print rc

GET_LIST(:B1)
--------------------
CURSOR STATEMENT : 1

CURSOR STATEMENT : 1

     EMPNO ENAME      JOB              SAL
---------- ---------- --------- ----------
      7934 MILLER     CLERK           1300
      7782 CLARK      MANAGER         2450
      7839 KING       PRESIDENT       5000

Sorted by SAL in descending order:

SQL> exec get_dept_list('sal desc', :rc)

PL/SQL procedure successfully completed.

SQL> print rc

GET_LIST(:B1)
--------------------
CURSOR STATEMENT : 1

CURSOR STATEMENT : 1

     EMPNO ENAME      JOB              SAL
---------- ---------- --------- ----------
      7839 KING       PRESIDENT       5000
      7782 CLARK      MANAGER         2450
      7934 MILLER     CLERK           1300


SQL>