If you really need this sort of dynamics, then use(as one of the options) weakly typed cursor. Here is an example (used dual table in this example).
set serveroutput on;
declare
l_c1 sys_refcursor;
l_query varchar2(255);
--------------------
l_column varchar2(11) := 'dummy'; -- column name
l_tabname varchar2(11) := 'dual'; -- table name
--------------------
l_res varchar2(1);
begin
l_query := 'select ' || dbms_assert.simple_sql_name(l_column) ||
' from ' || dbms_assert.simple_sql_name(l_tabname);
open l_c1 for l_query;
loop
fetch l_c1 into l_res;
exit when l_c1%notfound;
dbms_output.put_line(l_res);
end loop;
end;
result:
X
PL/SQL procedure successfully completed.
Note, that you'd need to know the type of variable(s) (or a collection if you'd decide to use bulk collect into) result would be fetched into, beforehand. Second, since identifiers (e.g. column names, table names) cannot be bound, you'd have to concatenate them explicitly after some sort of validation to prevent SQL injection.