title: Using regexp_replace to prevent SQL injection
body: <p>We have thousands of oracle packages that contain a map_products procedure.</p>
  
  <p>We have a table that stores the list of oracle packages a customer would like that map_products run for.</p>
  
  <p>The process that runs them uses dynamic SQL like this:</p>
  
  <pre><code>select sanitize(package_name) 
    into v_package_name 
  from   custom_plugins 
  where  id = p_id;
  
  execute immediate '
        begin 
            '||v_package_name||'.map_products; 
        end;
    ';
  </code></pre>
  
  <p>The sanitize function above is meant to prevent SQL injection.</p>
  
  <p>Here is the function definition:</p>
  
  <pre><code>function sanitize(p_string in varchar2) return varchar2
  is
  begin
      return regexp_replace(upper(p_string), 
                '(ALTER|MERGE|CREATE|SELECT|INSERT|UPDATE|DELETE|MODIFY|DROP|ENABLE|DISABLE|;)');
  end;
  </code></pre>
  
  <p>Now we realize this is a dangerous approach in the long run and are planning to redo the entire process. However, for the time being, is there any easy way that this regexp_replace can be circumvented allowing SQL injection?</p>
  
  <p>More specifically, we want to make sure that a semicolon cannot be passed in. Does the above ensure that?</p>