' on a procedure/function - sql

Question

I dont know when put '.
For example on a procedure, When i write execute immediate 'sentence'
if there are one value in the sentenece i put
'||valor||'
but on a function i dont know why i had to write
return 'UPPER(USER_NAME) = ''' || user || '''';
not only '||user||'.
Anyone can help me?

Answer 1

Don`t construct your query with concatenated values.
Use something like that instead
EXECUTE IMMEDIATE 'SELECT user_id FROM user_table WHERE UPPER( username ) = :1' INTO your_user_id USING UPPER( your_user_name );
It will handle all cases. In your example, what will happen if user contains a ' ? What if you have 2 successive ' ? It can be a real nightmare to handle.
Here's some examples from Oracle

Answer 2

user is a string in SQL and should be quoted in the SQL query: Your final query, apart from any escaping, should read UPPER(USER_NAME) = 'user', not UPPER(USER_NAME) = user.
But the whole query fragment is a string in PL/SQL, so you have to put a string in a string. To get the quotes for the SQL string in the PL/SQL string, you need to double them to 'escape' them, so Oracle doesn't think that the PL/SQL string itself ends.
So when you write '''', the outer quote define the boundaries of the (PL/SQL) string itself, and the inner two quotes are a single escaped quote inside that string.
Anyway, while this may be the actual answer to your question, and definitely helpful if you would need an empty set of quotes or a fixed string in your query, in general it's way better to use parameterized queries, so I urge you to follow Luc M's example.

Answer 3

here whatever comes within two single quotes(') will be considered as string. but what if you needed a string with single quotes within itself.
example,
if you need a word - sample - for a variable, it can be simply declared as l_var := 'sample'.
but if the string is needed with single quotes like - 'It's sample'??
in this case if we let as it is, the sql engine will read from first single quote to next single quote,.. likewise...
in this case we will use single quotes multiple times as required.
it can be referred from below example:
declare
single_quote_string varchar2(20):= 'sample';
multi_quote_string varchar2(20):= 'It''s sample';
multi_quote2_string varchar2(20):= '''It''s sample''';
begin
dbms_output.put_line('single_quote_string:'||single_quote_string);
dbms_output.put_line('multi_quote_string:'||multi_quote_string);
dbms_output.put_line('multi_quote2_string:'||multi_quote2_string);
end;
--output
single_quote_string:sample
multi_quote_string:It's sample
multi_quote2_string:'It's sample'
in your question , you were asking about use of : return 'UPPER(USER_NAME) = ''' || user || ''''; in execute immediate statement.
execute immediate is used to execute a string.
in your case, it's the where condition of user name.
when having normal sql, we will be having
upper(username) = 'SAMPLE';
but here this condition has to be passed as string to execute immediate command, meaning the single quotes which we use normally must be passed as a string, and hence we using multiple times.
if still not clear, you can try to display the execute immediate statement that you using in your code, which will output the sql command that you trying to run in execute immediate command.