As per this docco page: [link|http://download-uk.oracle.com/docs/cd/A87860_01/doc/server.817/a85397/function.htm#79574|http://download-uk.o...unction.htm#79574] .
Why, what's (most) wrong with it -- the "neither pretty", or the "nor foolproof" bit?
As for the first, I'm sorry, but I suspect this is as pretty as it gets...
As for the second, how big a concern is this? Could it be ("suffuciently") fixed by expanding the 'From' string in your code (so as to include at least lowercase letters and quote characters, for instance)?
If not, and you want it "more foolproof", that could be done -- at the expense of becoming a LOT less "pretty", though... And possibly introducing some real performance concerns. So, before I present you my SUSTR()- and DECODE()-based solution, please tell us: How long is your "textfield"? How many gazillion records are there in your table? And what, if any, limits are there to your run-time-window and server resource usage?