Explain bind variables in dynamic SQL and preventing SQL injection

Concatenating user input into a dynamic statement lets an attacker change its meaning and forces a hard parse per distinct value. Bind them: EXECUTE IMMEDIATE 'SELECT ... WHERE x = :v' USING p_val. Identifiers (table/column names) cannot be bound — validate them against the data dictionary or DBMS_ASSERT.SIMPLE_SQL_NAME / ENQUOTE_NAME, or map through an allow-list. DBMS_ASSERT also offers NOOP, SQL_OBJECT_NAME and SCHEMA_NAME checks.

CREATE OR REPLACE FUNCTION emp_count(p_col VARCHAR2, p_val VARCHAR2)
  RETURN NUMBER IS
  v_col  VARCHAR2(128) := DBMS_ASSERT.SIMPLE_SQL_NAME(p_col);  -- validate identifier
  v_n    NUMBER;
BEGIN
  EXECUTE IMMEDIATE
    'SELECT COUNT(*) FROM employees WHERE ' || v_col || ' = :v'
    INTO v_n USING p_val;                                       -- bind the value
  RETURN v_n;
END;
/