Code:
str2 := 'update ' || v_table_name || ' set ' || v_field_name || ' = '''||v_clob2||''' where rowid = ''' || v_row_id || '''';
EXECUTE IMMEDIATE str2;
Scary.
If that v_clob2 value contains single quotes and double dashes you could end up executing something like
update table set value ='I'--blah blah where rowid=....
and seriously screw up your database.
Even if you don't, using this sort of construct (dynamic sql without bind variables) can play havoc with your shared pool.