It's up to you ... if you choose DECODE, you can use it, but bear in mind it's usable only in a SQL statement.

You must know whether user filled a parameter, so you must have a value of parameter indicating "not given", for example:

(you didn't mention a language, I'll use PL/SQL)

Suppose we have table T with these columns of NUMBER type:
CN = contract number
IN = invoice number
TN = transaction number
...

Assume no one of them can be 0 (zero), then we can choose 0 as value for not-given-parameter.
Parameters are p_cn, p_in and p_tn and they are comming in this code from a user_interface. If a user filled a parameter, it doesn't contain 0.
...
WC:='' --means WhereClause :-)
IF p_cn!=0 THEN
WC:=WC||' AND CN='||to_char(p_cn);
END IF;

IF p_in!=0 THEN
WC:=WC||' AND CN='||to_char(p_in);
END IF;

IF p_tn!=0 THEN
WC:=WC||' AND CN='||to_char(p_tn);
END IF;

IF LENGTH(WC)>0 THEN
WC:=SUBSTR(WC,5); --cut off first AND
WC:='WHERE'||WC;
END IF;
FQUERY:='SELECT * FROM T '||WC;
--then use dbms_sql for opening cursor ...

If you need more info, just write.
Ales