You cannot bind identifiers. If the list of tables (identifiers) is dynamic (table driven), then using dynamic SQL would be applicable.
Never say Never
Never say Always
I Always say.
I will not say that I always use dynamic sql for this case, but there is a good chance I might.
dbms_assert is documented:
http://docs.oracle.com/docs/cd/E11882_01/appdev.112/e16760/d_assert.htm#ARPLS65375 If you do not know of it AND you write dynamic sql
then
you are probably subject to sql injection
end if