SQL & PL/SQL :: Execute Immediate Doesn't Like Dynamic String

why is this procedure with EXECUTE IMMEDIATE not working for me, when I pass a dynamic string to it.

this is the proc:

CREATE OR REPLACE FUNCTION MIGRATION.execute_sql (pSQL varchar2) RETURN varchar2 IS
vResult Varchar(200);
BEGIN
vResult := null;
[code]......

and when I invoke it like this it's fine:

select execute_sql ('select sysdate from dual') test from dual. However, when I try something like this, it won't work:

select execute_sql ('select max(al_code) from alert_log where al_user= '||user) test_sql from dual

the error message I get is:

ORA-00904: "MIGRATION": invalid identifier
ORA-06512: at "MIGRATION.EXECUTE_SQL", line 26