Use concatenation to wrap string passed in
SQL> CREATE OR REPLACE PROCEDURE format_string( string_in IN OUT VARCHAR2 ) IS 2 BEGIN 3 string_in := '['||string_in||']'; 4 END; 5 / Procedure created. SQL>