The dbms_assert package is used in databases that don’t employ bind variables to help prevent SQL injection attacks, by “sanitizing” the SQL.

it has several procedures inside ex :

• simple_sql_name: Validates the syntax of the SQL to ensure that the SQL statement only contains valid characters and proper quotes around internal values.
• schema_name: Allows you to validate a schema name against the dictionary

and this a simple example of using (dbms_assert.simple_sql_name)

[code]CREATE OR REPLACE PROCEDURE oraask_test (tbl_name VARCHAR2, col_name VARCHAR2)
IS
qry VARCHAR2 (500);
BEGIN
qry := ‘ALTER TABLE ‘ || dbms_assert.simple_sql_name ( :tbl_name) || ‘ ADD ‘ || :col_name || char (1);

EXECUTE IMMEDIATE qry USING col_name;
END oraask_test;[/code]