防sql注入的oracle函数

CREATE OR REPLACE TYPE str_split IS TABLE OF VARCHAR2 (4000);

CREATE OR REPLACE FUNCTION splitstr(p_string IN VARCHAR2, p_delimiter IN VARCHAR2)

    RETURN str_split 

    PIPELINED

AS

    str1 varchar2(4000) := replace(p_string,'''','');  -- 去掉单引号

    v_length   NUMBER := LENGTH(str1);

    v_start    NUMBER := 1;

    v_index    NUMBER;

BEGIN

    WHILE(v_start <= v_length)

    LOOP

        v_index := INSTR(str1, p_delimiter, v_start);

        IF v_index = 0

        THEN

            PIPE ROW(SUBSTR(str1, v_start));

            v_start := v_length + 1;

        ELSE

            PIPE ROW(SUBSTR(str1, v_start, v_index - v_start));

            v_start := v_index + 1;

        END IF;

    END LOOP;

    RETURN;

END splitstr;

-- 测试

select 字段  from 表名 where 字段 in (

 select a.column_value fid from (select * from (select * from table(splitstr('++4uu0vtQFyNPvT+pYq5kiOVzh4=,++dn+T66RsuI85VIAGfkcyOVzh4=',',')) t)) a

 )