title: How to prevent SQL Injection in PL/SQL
body: <p>We have some few packages where we need to resolve some SQL Injection issues. I need some help to rewrite sql statement or sanitize the inputs.  Below is the line number where veracode throw the error.</p>
  <p>open c_ccl (p_part_nr,p_ctry_cd);</p>
  <p>// Source code</p>
  <pre><code>     CREATE OR REPLACE EDITIONABLE PACKAGE BODY &quot;schema&quot;.&quot;Test_PKG&quot; AS
  
    v_data t_cla_class_data;
  
    FUNCTION nat_eccn_cd( p_part_nr  IN    t_part_nr, p_ctry_cd    IN     t_ctry_cd         )            
    RETURN t_us_eccn_cd IS
    CURSOR c_ccl(p_part_nr CHAR, p_ctry_cd CHAR)  IS
    SELECT NAT_CCL_CD  FROM CLSDBA.CLA_EXP_PART_CTRY e
       WHERE  e.PART_NR = p_part_nr  AND e.CTRY_CD = p_ctry_cd
        ORDER BY e.VAL_FROM_DT DESC;
    v_ctry_cd char(4) := p_ctry_cd;
    v_trf_cd char(4);
    BEGIN
      v_data.nat_eccn_cd := NULL;
      open c_ccl (p_part_nr,p_ctry_cd);
      fetch c_ccl INTO v_data.nat_eccn_cd;
      close c_ccl;
      return (trim(v_data.nat_eccn_cd));
      exception when others then return NULL;
    end;
  </code></pre>