You can pass variables by reference, even in PL/SQL : NOCOPY « Function Procedure Packages « Oracle PL/SQL Tutorial

1. Oracle PL/SQL Tutorial
2. Function Procedure Packages
3. NOCOPY

SQL>
SQL> create or replace procedure p_validate(io_string IN OUT NOCOPY VARCHAR2)
  2  is
  3      v_invalid VARCHAR2(8):='!@#$%^&';
  4  begin
  5      io_string:=replace (io_string,v_invalid);
  6      if length(io_string)>4000
  7      then
  8          io_string:=substr(io_string,1,3997)||'...';
  9      end if;
 10  end;
 11  /

Procedure created.

SQL>