APEX

Hello,

I am developing a number of search input forms where the search SQL string is dynamically constructed in PL/SQL using dynamic SQL.
I now want to create a function to sanitize the user input strings to avoid SQL injection.

I tried using DBMS_ASSERT.simple_sql_name and this seems to work fine for character strings, but it also raises an error on strings starting with a number (for example: SELECT dbms_assert.simple_sql_name('123TEST')
FROM dual), and this is not what I want.

Is there another solution for this except writing my own function?


Thanks,
Matthias