Handle dynamic parameter when null in the stored procedure - stored-procedures

Question

I working on a stored procedure in redshift. I see that when parameters passed are NULL to the Execute statement in stored procedure. It fails with cannot execute a null string.
Please give me insights on how to solve the problem.
Stored Procedure:
CREATE OR REPLACE PROCEDURE outer_proc() LANGUAGE plpgsql
AS $$
DECLARE
cond_holder RECORD;
iter RECORD;
BEGIN
drop table if exists tmp_direction_comms;
create temporary table tmp_direction_comms as select distinct code from direction_coms;
DROP TABLE if exists final_direction_comms;
EXECUTE 'CREATE TEMP TABLE final_direction_comms
(
code varchar(100),
direction varchar(100),
dir_flg Boolean
)';
FOR iter IN select code from tmp_direction_comms LOOP
RAISE INFO 'code is %', iter.code;
SELECT INTO cond_holder distinct condition FROM mapping where code = iter.code;
RAISE INFO 'engmnt_cd is %', cond_holder.condition;
EXECUTE 'INSERT INTO final_direction_comms select code, direction, case when NVL('||cond_holder.condition||',false) then true else false end as dir_flg
from direction_coms where code = '''||iter.code||'''';
END LOOP;
END;
$$;

Answer 1

EXECUTE 'INSERT INTO final_direction_comms select code, direction,
case when NVL('||cond_holder.condition||',false) then true else false end as dir_flg
from acp_edw.stg_edw.direction_coms where code = '''||iter.code||'''';
There are two variables that can be NULL - iter.code or cond_holder.condition. The cond_holder.condition is wrapped by NVL, but NVL is inside in result string, not in generating expression.
Second big issue is a vulnerability against SQL injection. Probably you should to do:
EXECUTE 'INSERT INTO final_direction_comms select code, direction,
case when ' || NVL(cond_holder.condition, false) ' || then true else false end as dir_flg
from acp_edw.stg_edw.direction_coms where code = $1'
USING iter.code;
I am not sure if Redshift has support for USING clause. If not, then you should to use quote_literal function:
'... where code = ' || quote_literal(iter.code);